CVE-2026-76835

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real reque...

CVE-2026-76835 OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real reque...

CVE-2026-76835 OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real reque...

Malicious code in @x-team/strapi (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-15685 Malicious code in @x-team/strapi (npm)

--- -= Per source details. Do not edit below this line.=-...

pwnfaces

😛 pwnfaces Exploit di iniezione EL in PrimeFaces 5.X 🕵️ Cos'è pwnfaces? 🕵️ pwnfaces è uno strumento Golang creato per sfruttare la vulnerabilità definita come CVE-2017-1000486 iniezione EL in PrimeFaces 5.X ⚡ Installazione / Per iniziare Una guida rapida su come installare e usare pwnfaces...

CVE-2026-45045

A flaw was found in the GoFiber web framework's BalancerForward proxy helper. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Real-IP header. Because the Header.Add function is used instead of Header.Set, an attacker-supplied X-Real-IP value is forwarde...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in golang.org/x/text.

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in golang.org/x/text. CVE-2026-56852 The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-56852 DESCRIPTION: A norm.Iter can enter an infinite loop when handli...

stealth_call

Cos'è? Libreria header-only per Windows x64 che consente di invocare qualsiasi syscall NT senza toccare gli import di ntdll, senza lasciare stringhe nel binario e senza i soliti campanelli d'allarme che fanno impazzire gli EDR. Niente CRT. Niente STL. Niente IAT. L'intero progetto compila a circa...

CVE-2026-56865

A flaw was found in golang.org/x/mod/sumdb/tlog. A malicious Go proxy GOPROXY could exploit this vulnerability by forging sumdb tiles. This allowed the proxy to bypass integrity checks and serve malicious module content to a local Go module cache, which would then go undetected by the transparenc...

Malicious Package

Overview tms-x-headers is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-76835: Authentication Bypass by Spoofing

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real reque...

Microsoft .net Core SEoL (10.x)

According to its version, Microsoft .net Core is 10.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

YARA-X 1.20.0

YARA-X is a re-incarnation of YARA, a pattern matching tool designed with malware researchers in mind. This new incarnation intends to be faster, safer and more user-friendly than its predecessor. The ultimate goal of YARA-X is replacing YARA as the default pattern matching tool for malware...

Microsoft .net Core SEoL (8.x)

According to its version, Microsoft .net Core is 8.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

SPIP X-Spip-Filtre Unauthenticated Remote Code Execution

This Metasploit module exploits a PHP function-call injection in SPIPs template engine. The analyseresultatskel function extracts the X-Spip-Filtre: ... patterns from the rendered page body and calls the listed functions as template filters. A newline character is injected into a GET parameter...

Microsoft .net Core SEoL (9.x)

According to its version, Microsoft .net Core is 9.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

SUSE CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

SUSE CVE-2026-72817

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...

oauth2-proxy: github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy: Authentication bypass due to spoofed X-Forwarded-Uri header

A flaw was found in OAuth2 Proxy. When configured with --reverse-proxy and either --skip-auth-regex or --skip-auth-route, the proxy may trust a client-supplied X-Forwarded-Uri header. An unauthenticated remote attacker can exploit this by spoofing the header, leading to an authentication bypass...