CVE-2026-58172Critical· 9.1▾ AbyssalPoC availableOcelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline …
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 50.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.6%
Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests from blocked IP addresses to be proxied to downstream services without enforcement of the configured allow/block list.
Ocelot <= 24.1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84473NoneCVE-2026-84473
CVE-2026-73577NoneApache OFBiz: Unauthenticated path-suffix view authorization bypass
CVE-2026-116606Critical· 9.3Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
CVE-2026-119420High· 8.8Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation
CVE-2026-63190Critical· 9.4FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
CVE-2026-118681Low· 3.7go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware