CVE-2026-108162

Published 10 October 2026 · tracked since 11 October 2026

Description

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/s

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-105892 CRITICAL 9.8
• CVE-2026-62044 HIGH 7.2
• CVE-2026-104398 CRITICAL 9.8
• CVE-2026-108546 HIGH 7.5
• CVE-2026-94676 HIGH 7.2
• CVE-2026-105885 HIGH 8.8
• CVE-2026-108164 MEDIUM 6.5
• CVE-2026-91136 HIGH 7.5
• CVE-2026-96662 HIGH 7.5
• CVE-2026-93945 CRITICAL 9.8

→ Open the live CVE board · all tools