CVE WatchOct 2, 2026

CVE-2026-94422

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message f

CVSS

8.8

High

EPSS

0.7%

p52

KEV

—

Exploit Today

0-100

Published: Oct 2, 2026 · Last modified: Oct 2, 2026 · CWE-290

EPSS · 30d

0.7%EPSS · 30 days0.7%

2026-10-032026-10-21

Technical description

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1122419.8 CRI

—

———Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.3h CVE-2026-1146408.7 HIG

—

———Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities.2h CVE-2026-1074475.3 MED

9.7%

——3The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.23h CVE-2026-1033025.3 MED

4.1%

——1The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid, and to force arbitrary orders into a failed state regardless of the gateway's configuration.23h CVE-2026-1137039.3 CRI

37.1%

——11SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.2d CVE-2026-1116917.4 HIG

34.0%

——10WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.6d