Traefik - Open Redirect

Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3 contains an open redirect vulnerability in the X-Forwarded-Prefix header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-15129 info: name:...

Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

EUVD-2026-41937

Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false...

CVE-2026-48061

Litestar prior to v2.22.0 is affected by CVE-2026-48061: AllowedHostsMiddleware may bypass host validation by using X-Forwarded-Host when Host is absent, enabling host-header injection (e.g., password reset links, cache keys, routing decisions). The issue occurs when no reverse proxy strips X-For...

CVE-2026-48061 Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the...

EUVD-2026-51595

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain...

CVE-2026-25552

The CVE-2026-25552 entry concerns Ghost CLI before 1.30.1, where an IP spoofing vulnerability allows unauthenticated remote attackers to bypass rate-limiting on self-hosted Ghost instances. The underlying issue is misusing the X-Forwarded-For header in combination with a misconfigured Nginx setup...

CVE-2026-25552 Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain...

SUSE CVE-2026-55430

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the target app from httpapi.RequestHost which prefers the X-Forwarded-Host header over the real Host header. No middleware...

CVE-2026-18174

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

CVE-2026-18174 @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

CVE-2026-18174

The CVE-2026-18174 entry concerns @fastify/forwarded. In versions before 3.0.2, the X-Forwarded-For parser trims only spaces when entries are comma-separated and does not strip horizontal tabs. As a result, an entry padded with a tab retains a literal tab in the resolved client IP string, potenti...

CVE-2026-18174 @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

CVE-2026-49332

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys X-Forwarded-User but does not strip underscore-variant keys XForwardedUser from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing a...

CVE-2026-59897

A flaw was found in Hono, a web application framework. The AWS API Gateway v1 adapter incorrectly de-duplicates repeated request header values using a substring comparison, rather than an exact match. This can lead to incomplete data being received by middleware or application logic that relies o...

Linux Distros Unpatched Vulnerability : CVE-2026-63771

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the...

GO-2026-5775 Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi...

CVE-2026-54764

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. The ForwardAuth middleware, even when configured to not trust forwarded headers, incorrectly uses the original incoming request to determine the X-Forwarded-Port header sent to the authentication service. This allows an...

CVE-2026-11922

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

CVE-2026-11922 Rate-limit Bypass in zenml-io/zenml

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...