tag
Cwe-290
Critical
Gitea Docker Image Reverse-Proxy Authentication Bypass — "One Header, Any User" (CVE-2026-20896)
CVE-2026-20896 (GHSA-f75j-4cw6-rmx4)·
Gitea — official Docker images (gitea/gitea), both root and rootless variants
patched
Critical
JAY Login & Register "Switch Back" Cookie Authentication Bypass (CVE-2025-14440)
CVE-2025-14440·
JAY Login & Register (WordPress plugin)
unpatched
High
phpSysInfo IP Allowlist Bypass via X-Forwarded-For Spoofing — CVE-2026-55584
CVE-2026-55584 / GHSA-786w-p5pm-cvgh·
phpSysInfo
patched
Critical
LiteLLM Proxy Unauthenticated Auth Bypass via Host-Header Route Confusion (CVE-2026-49468)
CVE-2026-49468·
LiteLLM (BerriAI) proxy
patched