Monthly
Header spoofing in fastify 5.8.3 through 5.12.0 persists despite the prior CVE-2026-3635 patch because the numeric trustProxy form compiles to a hop-count predicate that structurally ignores the connecting address, rendering the guard introduced by the earlier fix completely ineffective for this configuration. An attacker who can reach the Fastify origin server directly - bypassing the front-facing reverse proxy - can forge X-Forwarded-For, X-Forwarded-Host, and related fields that fastify uses to derive request.ip, request.hostname, request.host, and request.protocol, enabling host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin spoofing, and host-based routing and cache poisoning. No public exploit has been identified at time of analysis; the vendor-released fix is fastify 5.12.1, which disables the numeric trustProxy form entirely.
IP spoofing via X-Forwarded-For header manipulation in Ghost CLI before 1.30.1 enables unauthenticated remote attackers to defeat rate-limiting controls on self-hosted Ghost instances. The vulnerability arises when Nginx is configured with the $proxy_add_x_forwarded_for directive, which appends attacker-supplied IP values to the header chain, causing Ghost's rate-limiter to treat each crafted request as originating from a distinct, unseen IP address. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the low attack complexity makes this straightforward to abuse once a vulnerable instance is identified.
HTTP security header spoofing in CodeIgniter4 prior to 4.7.4 allows remote unauthenticated attackers to trick the framework into treating plain HTTP requests as HTTPS by injecting forged X-Forwarded-Proto or Front-End-Https headers. The root cause is that IncomingRequest::isSecure() unconditionally trusted these headers from any source rather than restricting trust to configured trusted proxies, undermining isSecure(), force_https(), and forceGlobalSecureRequests enforcement logic. No public exploit or CISA KEV listing exists; real-world impact is conditioned on deployment topology and CVSS AC:H reflects this complexity.
DNS response policy rewriting in NLnet Labs Unbound 1.6.2 through 1.25.1 bypasses DNSSEC validation when the respip module is positioned ahead of the validator with response-ip or RPZ-IP redirect rules active. The rewriting handler fails to check upstream DNSSEC security status, allowing a spoofed BOGUS A/AAAA answer whose address falls within an operator-configured redirect subnet to be rewritten and returned to clients with a hardcoded INSECURE security level rather than being rejected as BOGUS. No public exploit code has been identified at time of analysis, but the integrity impact is concrete: clients receive silently misdirected responses that appear to pass through legitimate operator-controlled policy, undermining the core DNSSEC trust guarantee for affected deployments.
Unauthenticated information disclosure in FileCodeBox before 2.4 lets remote attackers defeat the IPRateLimit anti-bruteforce control by spoofing X-Real-IP and X-Forwarded-For headers, which the application trusted without verifying the request originated from a configured reverse proxy. By rotating a unique fake IP on every request, an attacker resets their throttling counter indefinitely and can brute-force the short share codes to download other users' files. CVSS 4.0 is 8.7 (high), the fix shipped in release V2.4, and no public exploit or CISA KEV listing was identified at time of analysis.
Brute-force protection bypass in Glance (glanceapp/glance) 0.8.5 lets remote unauthenticated attackers defeat the per-IP failed-login lockout by rotating the leftmost value of the X-Forwarded-For header, but only when the server 'proxied' option is enabled. Because the authentication handler trusted the client-supplied leftmost XFF value instead of the trusted reverse proxy's rightmost value, each guess appears to come from a new IP and the lockout counter never trips, enabling unlimited credential guessing against the login endpoint. No public exploit identified at time of analysis and it is not in CISA KEV, though the upstream fix (PR #1033) and VulnCheck advisory make the technique trivially reproducible.
Log integrity spoofing in Eclipse Kura before 5.6.2 lets an unauthenticated remote attacker forge the client IP recorded in audit logs by supplying a crafted X-Forwarded-For header, because the Jetty ForwardedRequestCustomizer is installed unconditionally on every connector and getRemoteAddr() reflects the header value. This enables bypass of IP-based brute-force defenses like fail2ban (spoofing a non-routable source to evade bans) or a denial of service against a third party by injecting a victim IP so their address is banned. No public exploit is identified at time of analysis and it is not on CISA KEV; CVSS 4.0 base score is 8.8.
Authentication bypass in Hermes WebUI before 0.51.307 lets unauthenticated remote attackers reach onboarding endpoints that are supposed to be restricted to loopback traffic by spoofing an X-Forwarded-For header with a 127.0.0.1 value. Once past the origin check, an attacker can pivot to server-side request forgery against internal services and cloud metadata endpoints, overwrite LLM provider configuration and API keys, or start an OAuth device-code flow to mint persistent tokens saved in auth.json. A vendor patch exists; the flaw carries a CVSS 4.0 score of 9.3, but no public exploit code has been identified at time of analysis.
Header de-duplication logic in Hono's AWS API Gateway v1 adapter silently drops distinct repeated header values because it uses substring comparison rather than exact string equality, meaning a value like '10.0.0.1' would incorrectly suppress '10.0.0.10'. Middleware or application logic relying on a complete X-Forwarded-For chain, rate limiting counters, audit trail integrity, or proxy-chain trust validation receives a truncated view of the request. Affected versions span 4.3.3 through 4.12.26; no public exploit identified at time of analysis, though the GitHub advisory confirms the issue and a fix is released in v4.12.27.
Security-control bypass in OpenSSH sshd before 10.4 causes the DisableForwarding=yes hardening directive to be silently ignored when PermitTunnel=yes is also set, so tun-device forwarding remains available despite an administrator's explicit policy to disable all forwarding. Affected operators are those who rely on DisableForwarding as a defense-in-depth restriction; the flaw lets an authenticated user establish layer-2/3 tunnels the configuration was meant to forbid. There is no public exploit identified at time of analysis, EPSS is low (0.13%, 3rd percentile), and it is not on CISA KEV.
Header spoofing in fastify 5.8.3 through 5.12.0 persists despite the prior CVE-2026-3635 patch because the numeric trustProxy form compiles to a hop-count predicate that structurally ignores the connecting address, rendering the guard introduced by the earlier fix completely ineffective for this configuration. An attacker who can reach the Fastify origin server directly - bypassing the front-facing reverse proxy - can forge X-Forwarded-For, X-Forwarded-Host, and related fields that fastify uses to derive request.ip, request.hostname, request.host, and request.protocol, enabling host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin spoofing, and host-based routing and cache poisoning. No public exploit has been identified at time of analysis; the vendor-released fix is fastify 5.12.1, which disables the numeric trustProxy form entirely.
IP spoofing via X-Forwarded-For header manipulation in Ghost CLI before 1.30.1 enables unauthenticated remote attackers to defeat rate-limiting controls on self-hosted Ghost instances. The vulnerability arises when Nginx is configured with the $proxy_add_x_forwarded_for directive, which appends attacker-supplied IP values to the header chain, causing Ghost's rate-limiter to treat each crafted request as originating from a distinct, unseen IP address. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the low attack complexity makes this straightforward to abuse once a vulnerable instance is identified.
HTTP security header spoofing in CodeIgniter4 prior to 4.7.4 allows remote unauthenticated attackers to trick the framework into treating plain HTTP requests as HTTPS by injecting forged X-Forwarded-Proto or Front-End-Https headers. The root cause is that IncomingRequest::isSecure() unconditionally trusted these headers from any source rather than restricting trust to configured trusted proxies, undermining isSecure(), force_https(), and forceGlobalSecureRequests enforcement logic. No public exploit or CISA KEV listing exists; real-world impact is conditioned on deployment topology and CVSS AC:H reflects this complexity.
DNS response policy rewriting in NLnet Labs Unbound 1.6.2 through 1.25.1 bypasses DNSSEC validation when the respip module is positioned ahead of the validator with response-ip or RPZ-IP redirect rules active. The rewriting handler fails to check upstream DNSSEC security status, allowing a spoofed BOGUS A/AAAA answer whose address falls within an operator-configured redirect subnet to be rewritten and returned to clients with a hardcoded INSECURE security level rather than being rejected as BOGUS. No public exploit code has been identified at time of analysis, but the integrity impact is concrete: clients receive silently misdirected responses that appear to pass through legitimate operator-controlled policy, undermining the core DNSSEC trust guarantee for affected deployments.
Unauthenticated information disclosure in FileCodeBox before 2.4 lets remote attackers defeat the IPRateLimit anti-bruteforce control by spoofing X-Real-IP and X-Forwarded-For headers, which the application trusted without verifying the request originated from a configured reverse proxy. By rotating a unique fake IP on every request, an attacker resets their throttling counter indefinitely and can brute-force the short share codes to download other users' files. CVSS 4.0 is 8.7 (high), the fix shipped in release V2.4, and no public exploit or CISA KEV listing was identified at time of analysis.
Brute-force protection bypass in Glance (glanceapp/glance) 0.8.5 lets remote unauthenticated attackers defeat the per-IP failed-login lockout by rotating the leftmost value of the X-Forwarded-For header, but only when the server 'proxied' option is enabled. Because the authentication handler trusted the client-supplied leftmost XFF value instead of the trusted reverse proxy's rightmost value, each guess appears to come from a new IP and the lockout counter never trips, enabling unlimited credential guessing against the login endpoint. No public exploit identified at time of analysis and it is not in CISA KEV, though the upstream fix (PR #1033) and VulnCheck advisory make the technique trivially reproducible.
Log integrity spoofing in Eclipse Kura before 5.6.2 lets an unauthenticated remote attacker forge the client IP recorded in audit logs by supplying a crafted X-Forwarded-For header, because the Jetty ForwardedRequestCustomizer is installed unconditionally on every connector and getRemoteAddr() reflects the header value. This enables bypass of IP-based brute-force defenses like fail2ban (spoofing a non-routable source to evade bans) or a denial of service against a third party by injecting a victim IP so their address is banned. No public exploit is identified at time of analysis and it is not on CISA KEV; CVSS 4.0 base score is 8.8.
Authentication bypass in Hermes WebUI before 0.51.307 lets unauthenticated remote attackers reach onboarding endpoints that are supposed to be restricted to loopback traffic by spoofing an X-Forwarded-For header with a 127.0.0.1 value. Once past the origin check, an attacker can pivot to server-side request forgery against internal services and cloud metadata endpoints, overwrite LLM provider configuration and API keys, or start an OAuth device-code flow to mint persistent tokens saved in auth.json. A vendor patch exists; the flaw carries a CVSS 4.0 score of 9.3, but no public exploit code has been identified at time of analysis.
Header de-duplication logic in Hono's AWS API Gateway v1 adapter silently drops distinct repeated header values because it uses substring comparison rather than exact string equality, meaning a value like '10.0.0.1' would incorrectly suppress '10.0.0.10'. Middleware or application logic relying on a complete X-Forwarded-For chain, rate limiting counters, audit trail integrity, or proxy-chain trust validation receives a truncated view of the request. Affected versions span 4.3.3 through 4.12.26; no public exploit identified at time of analysis, though the GitHub advisory confirms the issue and a fix is released in v4.12.27.
Security-control bypass in OpenSSH sshd before 10.4 causes the DisableForwarding=yes hardening directive to be silently ignored when PermitTunnel=yes is also set, so tun-device forwarding remains available despite an administrator's explicit policy to disable all forwarding. Affected operators are those who rely on DisableForwarding as a defense-in-depth restriction; the flaw lets an authenticated user establish layer-2/3 tunnels the configuration was meant to forbid. There is no public exploit identified at time of analysis, EPSS is low (0.13%, 3rd percentile), and it is not on CISA KEV.