CVE-2026-48061

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the...

PT-2026-66676

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request a...

SUSE CVE-2026-55078

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, POST /api/v2/files converts zip uploads to tar in memory via CreateTarFromZip, which enforced a per-entry size limit but no...

[SECURITY] Fedora 43 Update: nginx-1.30.4-1.fc43

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser http/src/main/java/org/http4s/blaze/http/parser/ cause request-boundary disagreement with a stricter intermediary. All are reachable from a default BlazeServerBuilder with no non-default configuration. Impa...

GHSA-MHVJ-JHPQ-885V blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser http/src/main/java/org/http4s/blaze/http/parser/ cause request-boundary disagreement with a stricter intermediary. All are reachable from a default BlazeServerBuilder with no non-default configuration. Impa...

CVE-2026-21723

A flaw was found in Grafana. A remote attacker with very low privileges, or even anonymous access if enabled, can exploit the alertmanager templates test endpoint by mass-executing templates. This can lead to an Out-Of-Memory OOM error, causing the Grafana service to crash and resulting in a Deni...

SUSE CVE-2026-63771

Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to...

[SECURITY] Fedora 44 Update: nginx-1.30.4-1.fc44

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook

Impact The DELETE /$restEndpoint/test-webhook/:id route is registered before the authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress te...

GO-2026-6051 Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` in code.gitea.io/gitea

Gitea Docker image: REVERSEPROXYTRUSTEDPROXIES = default lets any source IP impersonate any user via X-WEBAUTH-USER in code.gitea.io/gitea...

Duplicate Advisory: Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qq9q-x9w4-chhj. This link is maintained to preserve external references. Original Description Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API...

EUVD-2026-41614

Gitea Docker image: REVERSEPROXYTRUSTEDPROXIES = default lets any source IP impersonate any user via X-WEBAUTH-USER...

GHSA-F75J-4CW6-RMX4 Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

Summary The Gitea Docker images ship an app.ini template that hard-codes: REVERSEPROXYTRUSTEDPROXIES = The documented default for this setting, in custom/conf/app.example.ini, is 127.0.0.0/8,::1/128, i.e. only loopback is trusted. When an admin enables ENABLEREVERSEPROXYAUTHENTICATION = true to p...

CVE-2026-15927

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an externalreference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validateexternalregistryurl. A repository...

CVE-2026-63771

Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to...

DEBIAN-CVE-2026-63771

Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to...

CVE-2026-63771

Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to...

CVE-2026-63771

Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to...

CVE-2026-64619 FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers

FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers...