Início / CVEs
Base de CVEs
Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.
CVE-2026-24910
Média · 5.9
CWE-348 27/01/2026
In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be…
In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matching name (for file, link, git, or github).
CVE-2025-13694
Média · 5.3
CWE-348 07/01/2026
AA Block country <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Header
The AA Block Country plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.0.1. This is due to the plugin trusting user-supplied headers such as HTTP_X_FORWARDED_FOR to determine the client's IP address without proper validation or considering if the server is behind a trusted proxy. This makes it possible for unauthenticated attackers to bypass IP-based access restrictions by spoofing their IP address via the X-Forwarded-For header.
CVE-2025-32900
Média · 4.3
CWE-348 05/12/2025
In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to...
In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, because broadcast UDP is used. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.