agentprime: CWE-348Every new CWE-348 Advisory and CVE.https://agentprime.io/CVE-2026-77463: Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deploymenthttps://agentprime.io/advisories/CVE-2026-77463/https://agentprime.io/advisories/CVE-2026-77463/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:54:09 GMTCVECVE-2026-86041: ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` headerhttps://agentprime.io/advisories/CVE-2026-86041/https://agentprime.io/advisories/CVE-2026-86041/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 22:15:56 GMTCVECVE-2026-120633: CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_porthttps://agentprime.io/advisories/CVE-2026-120633/https://agentprime.io/advisories/CVE-2026-120633/Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 23:40:04 GMTCVECVE-2026-119711: PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Headerhttps://agentprime.io/advisories/CVE-2026-119711/https://agentprime.io/advisories/CVE-2026-119711/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 15:16:10 GMTCVEchi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-Forhttps://agentprime.io/advisories/GHSA-j6qf-3m9c-vwj3/https://agentprime.io/advisories/GHSA-j6qf-3m9c-vwj3/github.com/go-chi/chi/v5 <5.4.0, fixed in 5.4.0. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 23 Oct 2026 20:56:46 GMTGogithub.com/go-chi/chi/v5Echo: X-Real-IP extractor trusts the header value instead of the sending peerhttps://agentprime.io/advisories/GHSA-h53f-rm2w-w7rg/https://agentprime.io/advisories/GHSA-h53f-rm2w-w7rg/github.com/labstack/echo/v5 >=5.0.0, <5.4.1, fixed in 5.4.1. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 23 Oct 2026 20:50:25 GMTGogithub.com/labstack/echo/v5CVE-2026-112378: Use of Less Trusted Source in GitLabhttps://agentprime.io/advisories/CVE-2026-112378/https://agentprime.io/advisories/CVE-2026-112378/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 23:33:50 GMTCVEDuplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-Forhttps://agentprime.io/advisories/GHSA-7cgw-qmxx-7fc2/https://agentprime.io/advisories/GHSA-7cgw-qmxx-7fc2/github.com/go-chi/chi/v5 <=5.3.2, no fixed version yet. CVSS 4.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 21 Oct 2026 15:42:31 GMTGogithub.com/go-chi/chi/v5CVE-2026-114474: Use of Less Trusted Source in hMailServerhttps://agentprime.io/advisories/CVE-2026-114474/https://agentprime.io/advisories/CVE-2026-114474/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 15:12:15 GMTCVECVE-2026-107567: Use of Less Trusted Source in hMailServerhttps://agentprime.io/advisories/CVE-2026-107567/https://agentprime.io/advisories/CVE-2026-107567/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 15:34:17 GMTCVECVE-2026-111934: Coder before 2.34.7 IP Spoofing via X-Forwarded-For Headerhttps://agentprime.io/advisories/CVE-2026-111934/https://agentprime.io/advisories/CVE-2026-111934/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 17 Oct 2026 18:46:44 GMTCVECVE-2026-111450: Wheels: Wheels through 4.1.1 derives its default production error-email address from the Host…https://agentprime.io/advisories/CVE-2026-111450/https://agentprime.io/advisories/CVE-2026-111450/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 03:49:20 GMTCVECVE-2026-111443: Wheels: Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a…https://agentprime.io/advisories/CVE-2026-111443/https://agentprime.io/advisories/CVE-2026-111443/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 03:28:28 GMTCVECVE-2026-110726: Resource allocation without limits in Eclipse Foundation Eclipse Connected Services Platformhttps://agentprime.io/advisories/CVE-2026-110726/https://agentprime.io/advisories/CVE-2026-110726/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 11:58:03 GMTCVECVE-2026-93483: Znuny: In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and…https://agentprime.io/advisories/CVE-2026-93483/https://agentprime.io/advisories/CVE-2026-93483/CVSS 9.5 (Critical). Critical: CVSS score 9.5: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 03:43:10 GMTCVEcriticalCVE-2026-108736: Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofinghttps://agentprime.io/advisories/CVE-2026-108736/https://agentprime.io/advisories/CVE-2026-108736/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 11 Oct 2026 12:19:42 GMTCVECVE-2026-108555: PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Headerhttps://agentprime.io/advisories/CVE-2026-108555/https://agentprime.io/advisories/CVE-2026-108555/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Sat, 10 Oct 2026 14:49:39 GMTCVECVE-2026-108162: Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-Forhttps://agentprime.io/advisories/CVE-2026-108162/https://agentprime.io/advisories/CVE-2026-108162/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 10 Oct 2026 13:55:13 GMTCVECVE-2026-78015: Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…https://agentprime.io/advisories/CVE-2026-78015/https://agentprime.io/advisories/CVE-2026-78015/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Oct 2026 08:30:01 GMTCVECVE-2026-107271: Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofinghttps://agentprime.io/advisories/CVE-2026-107271/https://agentprime.io/advisories/CVE-2026-107271/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 07 Oct 2026 15:44:05 GMTCVEPyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionhttps://agentprime.io/advisories/GHSA-x33g-cr3x-6449/https://agentprime.io/advisories/GHSA-x33g-cr3x-6449/pyjwt >=2.1.0, <2.15.0, fixed in 2.15.0. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Mon, 05 Oct 2026 23:44:03 GMTPyPIpyjwtproxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnethttps://agentprime.io/advisories/GHSA-jqcg-44mw-7w3h/https://agentprime.io/advisories/GHSA-jqcg-44mw-7w3h/proxy-addr >=1.1.0, <2.0.8, fixed in 2.0.8. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Mon, 05 Oct 2026 23:30:26 GMTnpmproxy-addrcriticalCVE-2026-105051: Irdeto Denuvo Anti-Tamper: Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via…https://agentprime.io/advisories/CVE-2026-105051/https://agentprime.io/advisories/CVE-2026-105051/CVSS 1.9 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 22:59:56 GMTCVECVE-2026-103592: simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headershttps://agentprime.io/advisories/CVE-2026-103592/https://agentprime.io/advisories/CVE-2026-103592/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 30 Sep 2026 23:02:36 GMTCVECVE-2026-102630: UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Hosthttps://agentprime.io/advisories/CVE-2026-102630/https://agentprime.io/advisories/CVE-2026-102630/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 29 Sep 2026 15:42:20 GMTCVECVE-2026-101277: Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted sourcehttps://agentprime.io/advisories/CVE-2026-101277/https://agentprime.io/advisories/CVE-2026-101277/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 23:45:15 GMTCVEvLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated ...https://agentprime.io/advisories/GHSA-hhv2-872h-628q/https://agentprime.io/advisories/GHSA-hhv2-872h-628q/vllm >=0.22.1, <0.28.0, fixed in 0.28.0. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Sat, 26 Sep 2026 14:16:47 GMTPyPIvllmCVE-2026-80514: wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypasshttps://agentprime.io/advisories/CVE-2026-80514/https://agentprime.io/advisories/CVE-2026-80514/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 08:34:15 GMTCVECVE-2026-97404: In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header.https://agentprime.io/advisories/CVE-2026-97404/https://agentprime.io/advisories/CVE-2026-97404/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 14:34:16 GMTCVEcriticalCVE-2026-92530: Use of Less Trusted Source in GitLabhttps://agentprime.io/advisories/CVE-2026-92530/https://agentprime.io/advisories/CVE-2026-92530/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 23:05:15 GMTCVECVE-2026-84718: Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trusthttps://agentprime.io/advisories/CVE-2026-84718/https://agentprime.io/advisories/CVE-2026-84718/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:33 GMTCVECVE-2026-87070: Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofinghttps://agentprime.io/advisories/CVE-2026-87070/https://agentprime.io/advisories/CVE-2026-87070/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 10:11:02 GMTCVEFabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection headerhttps://agentprime.io/advisories/GHSA-fq95-v8xc-jm3v/https://agentprime.io/advisories/GHSA-fq95-v8xc-jm3v/github.com/fabiolb/fabio >=1.6.6, <1.7.2, fixed in 1.7.2. CVSS 5.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 22 Sep 2026 20:34:22 GMTGogithub.com/fabiolb/fabiokcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspacehttps://agentprime.io/advisories/GHSA-c8w2-fgvx-vhv4/https://agentprime.io/advisories/GHSA-c8w2-fgvx-vhv4/github.com/kcp-dev/kcp <0.31.4 || >=0.32.0, <0.32.2, fixed in 0.31.4, 0.32.2. CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 18 Sep 2026 17:15:49 GMTGogithub.com/kcp-dev/kcpcriticaldjust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live pathhttps://agentprime.io/advisories/GHSA-v9rj-xjfv-xj9r/https://agentprime.io/advisories/GHSA-v9rj-xjfv-xj9r/djust <1.0.7, fixed in 1.0.7. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 16 Sep 2026 22:07:52 GMTPyPIdjustCVE-2026-92395: @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnethttps://agentprime.io/advisories/CVE-2026-92395/https://agentprime.io/advisories/CVE-2026-92395/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 14:35:05 GMTCVEcriticalCVE-2026-90679: Forgejo: Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set…https://agentprime.io/advisories/CVE-2026-90679/https://agentprime.io/advisories/CVE-2026-90679/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 13 Sep 2026 03:55:04 GMTCVECVE-2026-16272: Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS Modulehttps://agentprime.io/advisories/CVE-2026-16272/https://agentprime.io/advisories/CVE-2026-16272/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 09 Sep 2026 08:17:50 GMTCVEcriticalfastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-counthttps://agentprime.io/advisories/GHSA-3m5p-2c4r-xxw2/https://agentprime.io/advisories/GHSA-3m5p-2c4r-xxw2/fastify >=5.8.3, <5.12.1, fixed in 5.12.1. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 02 Sep 2026 15:14:06 GMTnpmfastify9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRFhttps://agentprime.io/advisories/GHSA-86m2-fcxq-5q7c/https://agentprime.io/advisories/GHSA-86m2-fcxq-5q7c/9router <0.5.2, fixed in 0.5.2. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 28 Aug 2026 18:33:20 GMTnpm9routerCodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()https://agentprime.io/advisories/GHSA-7wmf-pw8j-mc78/https://agentprime.io/advisories/GHSA-7wmf-pw8j-mc78/codeigniter4/framework <4.7.4, fixed in 4.7.4. CVSS 4.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 07 Aug 2026 18:21:54 GMTPackagistcodeigniter4/frameworkCVE-2026-25552: Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Headerhttps://agentprime.io/advisories/CVE-2026-25552/https://agentprime.io/advisories/CVE-2026-25552/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 18:12:40 GMTCVECVE-2026-50243: 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAILhttps://agentprime.io/advisories/CVE-2026-50243/https://agentprime.io/advisories/CVE-2026-50243/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Jul 2026 13:08:21 GMTCVEHono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplicationhttps://agentprime.io/advisories/GHSA-xgm2-5f3f-mvvc/https://agentprime.io/advisories/GHSA-xgm2-5f3f-mvvc/hono >=4.3.3, <4.12.27, fixed in 4.12.27. CVSS 4.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 21 Jul 2026 18:18:13 GMTnpmhonoCVE-2026-63770: Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypasshttps://agentprime.io/advisories/CVE-2026-63770/https://agentprime.io/advisories/CVE-2026-63770/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 19:02:36 GMTCVECVE-2026-64619: FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headershttps://agentprime.io/advisories/CVE-2026-64619/https://agentprime.io/advisories/CVE-2026-64619/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 18:50:12 GMTCVECVE-2026-9561: Insufficient verification of data authenticity in Eclipse Foundation Eclipse Kurahttps://agentprime.io/advisories/CVE-2026-9561/https://agentprime.io/advisories/CVE-2026-9561/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Jul 2026 07:59:20 GMTCVECVE-2026-58122: Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofinghttps://agentprime.io/advisories/CVE-2026-58122/https://agentprime.io/advisories/CVE-2026-58122/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 21:30:17 GMTCVEcriticalCVE-2026-59999: OpenBSD OpenSSH: In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence…https://agentprime.io/advisories/CVE-2026-59999/https://agentprime.io/advisories/CVE-2026-59999/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Jul 2026 00:13:08 GMTCVECVE-2026-46466: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7…https://agentprime.io/advisories/CVE-2026-46466/https://agentprime.io/advisories/CVE-2026-46466/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 03 Jul 2026 13:10:01 GMTCVE