CVE-2026-103592

Published 30 September 2026 · tracked since 1 October 2026

Description

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to impersona

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-97661 HIGH 7.2
• CVE-2026-92244 HIGH 7.2
• CVE-2026-95687 HIGH 8.8
• CVE-2026-96268 MEDIUM 6.4
• CVE-2026-96573 HIGH 7.2
• CVE-2026-96813 HIGH 7.2
• CVE-2026-15983 HIGH 8.1
• CVE-2026-85235 HIGH 7.2
• CVE-2026-89424 MEDIUM 6.4
• CVE-2026-90992 MEDIUM 6.4

→ Open the live CVE board · all tools