CWE-348

103 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 14High 18Medium 58Low 12Not scored 1

CVEs per yearBy the year they were published

CVE-2026-77463
Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment
umputun · remark42
Medium6.5
CVE-2026-86041
ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header
mayswind · ezbookkeeping
Medium5.3
CVE-2026-120633
CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port
CGI
Not scored
CVE-2026-119711
PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header
pipeshub-ai · pipeshub-ai
Medium6.9
CVE-2026-118265
Echo: X-Real-IP extractor trusts the header value instead of the sending peer
labstack · echo
Medium5.3
CVE-2026-112378
Use of Less Trusted Source in GitLab
GitLab · GitLab
Medium4.3
CVE-2026-114474
Use of Less Trusted Source in hMailServer
Progressive Robot Ltd · hMailServer
Medium5.9
CVE-2026-114437
Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For
go-chi · chi
Medium6.3
CVE-2026-107567
Use of Less Trusted Source in hMailServer
Progressive Robot Ltd · hMailServer
High7.5
CVE-2026-111934
Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header
coder · coder
Medium6.3