-
CVE-2026-118514
CVE-2026-118514: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls: Incomplete Fix for CVE-2026-45075
Affected versions
>=2.0.0,<3.0.0>=3.0.0,<4.0.0>=4.0.0,<5.0.0>=5.0.0,<5.1.0>=5.1.0,<5.2.0>=5.2.0,<5.3.0>=5.3.0,<5.4.0>=5.4.0,<5.4.56>=6.0.0,<6.1.0>=6.1.0,<6.2.0>=6.2.0,<6.3.0>=6.3.0,<6.4.0>=6.4.0,<6.4.50>=7.0.0,<7.1.0>=7.1.0,<7.2.0>=7.2.0,<7.3.0>=7.3.0,<7.4.0>=7.4.0,<7.4.23>=8.0.0,<8.1.0>=8.1.0,<8.1.11
Reported
4 Nov 2026, 10:45
View advisory
-
Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name
Affected versions
>=5.4.50,<5.4.56>=6.4.29,<6.4.50>=7.3.7,<7.4.0>=7.4.0,<7.4.23>=8.0.0,<8.1.0>=8.1.0,<8.1.11
Reported
4 Nov 2026, 00:00
View advisory
-
The "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies
Affected versions
>=7.2.0,<7.3.0>=7.3.0,<7.4.0>=7.4.0,<7.4.23>=8.0.0,<8.1.0>=8.1.0,<8.1.11
Reported
4 Nov 2026, 00:00
View advisory
-
Generated URLs Can Point to a Host Chosen by the Client
Affected versions
>=2.0.0,<2.1.0>=2.1.0,<2.2.0>=2.2.0,<2.3.0>=2.3.0,<2.4.0>=2.4.0,<2.5.0>=2.5.0,<2.6.0>=2.6.0,<2.7.0>=2.7.0,<2.8.0>=2.8.0,<3.0.0>=3.0.0,<3.1.0>=3.1.0,<3.2.0>=3.2.0,<3.3.0>=3.3.0,<3.4.0>=3.4.0,<4.0.0>=4.0.0,<4.1.0>=4.1.0,<4.2.0>=4.2.0,<4.3.0>=4.3.0,<4.4.0>=4.4.0,<5.0.0>=5.0.0,<5.1.0>=5.1.0,<5.2.0>=5.2.0,<5.3.0>=5.3.0,<5.4.0>=5.4.0,<5.4.56>=6.0.0,<6.1.0>=6.1.0,<6.2.0>=6.2.0,<6.3.0>=6.3.0,<6.4.0>=6.4.0,<6.4.50>=7.0.0,<7.1.0>=7.1.0,<7.2.0>=7.2.0,<7.3.0>=7.3.0,<7.4.0>=7.4.0,<7.4.23>=8.0.0,<8.1.0>=8.1.0,<8.1.11
Reported
4 Nov 2026, 00:00
View advisory