Use of Less Trusted Source

Every one of the 100 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Termix' official Docker image contains an authentication bypass vulnerabilityCVE-2025-59951LukeGus · CVSS 9.2 · 4.9% likely
2. mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismCVE-2022-31813Apache Software Foundation · 3.5% likely

   Apache

3. HTTP client can remove the X-Forwarded headers in TraefikCVE-2024-45410traefik · CVSS 9.8 · 1.5% likely

   Traefik

4. Nimble falls back to insecure http url when fetching packagesCVE-2021-21373nim-lang · CVSS 7.5 · 1.2% likely

   Nim-Lang

5. Nimble fails to validate certificates due to insecure httpClient defaultsCVE-2021-21374nim-lang · CVSS 8.1 · 1.0% likely

   Nim-Lang

6. A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the tar…CVE-2022-2255Modwsgi · 1.0% likely
7. Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism BypassCVE-2022-4539cyberlord92 · CVSS 5.3 · 0.6% likely

   Cyberlord92

8. Apache APISIX: wolf-rbac plugin Identity SpoofingCVE-2026-44046Apache Software Foundation · CVSS 2.3 · 0.5% likely

   Apache

9. Fabio allows HTTP clients to manipulate custom headers it addsCVE-2025-48865fabiolb · CVSS 9.1 · 0.5% likely
10. A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 allows an unauthenticated attack to bypass…CVE-2024-23105Fortinet · CVSS 7.1 · 0.4% likely

    Fortinet

11. PostgreSQL libpq retains an error message from man-in-the-middleCVE-2024-10977Postgresql · CVSS 3.1 · 0.4% likely

    Postgresql

12. Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header SpoofingCVE-2026-58122nesquena · CVSS 9.1 · 0.4% likely

    Nesquena

13. Action Pack: Possible IP spoofing in Action Dispatch RemoteIpCVE-2026-126083rails · CVSS 7.4 · 0.4% likely

    Rails

14. Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-348: Use of Less Trusted SourceCVE-2024-27773Unitronics · CVSS 8.8 · 0.4% likely

    Unitronics

15. Limit Login Attempts (Spam Protection) <= 5.3 - IP Address Spoofing to Protection Mechanism BypassCVE-2022-4534wp-buy · CVSS 5.3 · 0.3% likely

    Wp-Buy

16. vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin PropagationCVE-2026-100653vllm-project · CVSS 6.5 · 0.3% likely

    Vllm

17. Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism BypassCVE-2022-4537johndarrel · CVSS 6.5 · 0.3% likely

    John Darrel

18. FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed HeadersCVE-2026-64619vastsa · CVSS 7.5 · 0.3% likely
19. Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection BypassCVE-2026-63770glanceapp · CVSS 7.5 · 0.3% likely
20. Brizy Page Builder <= 2.4.18 - IP Address Spoofing to Protection Mechanism BypassCVE-2023-2897themefusecom · CVSS 3.7 · 0.3% likely

    Themefusecom

21. Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclip…CVE-2026-9561Eclipse Foundation · CVSS 8.8 · 0.3% likely

    Eclipse Foundation

22. URL (HTTP Origin) call location spoofing in Szafir SDK WebCVE-2026-26927Krajowa Izba Rozliczeniowa · CVSS 5.1 · 0.3% likely

    Krajowa Izba Rozliczeniowa

23. In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker w…CVE-2026-97404OpenStack · CVSS 9.2 · 0.3% likely

    Openstack

24. WordPress Solid Security plugin <= 9.3.1 - IP Spoofing Leading to Denial of Service vulnerabilityCVE-2022-44593SolidWP · CVSS 3.7 · 0.3% likely
25. WP Maintenance <= 6.1.9.2 - IP Spoofing to Maintenance Mode BypassCVE-2024-0789florent73 · CVSS 5.3 · 0.3% likely
26. PbootCMS Header handle.php get_user_ip less trusted sourceCVE-2025-15154Pbootcms · CVSS 5.3 · 0.3% likely

    Pbootcms

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.