Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the ForwardAuth process when trustForwardHeader is set to false. An attacker can bypass port-based authorization checks by injecting a crafted X-Forwarded-Proto header over an unencrypte...

CVE-2026-54764

Summary of CVE-2026-54764 : Traefik’s ForwardAuth middleware can leak spoofed port information due to incorrect header handling when trustForwardHeader is false. Before fixes, the middleware derived X-Forwarded-Port from the original incoming request rather than the sanitized forwarded request, a...

CVE-2026-32881

ewe is a Gleam web server. ewe is a Gleam web server. Versions 0.6.0 through 3.0.4 are vulnerable to authentication bypass or spoofed proxy-trust headers. Chunked transfer encoding trailer handling merges declared trailer fields into req.headers after body parsing, but the denylist only blocks 9...

Caddy Security Breach

Caddy is an open source, cross-platform HTTP/Web server from Caddy. A security vulnerability exists in Caddy-geo-ip GeoIP version 0.6.0, which stems from a vulnerability that allows an attacker to spoof the source IP address of his/her source IP address via the X-Forwarded-For header when using t...