Filtered by vendor Alexjustesen Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-108736 1 Alexjustesen 1 Speedtest-tracker 2026-10-13 3.7 Low
Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowlisted address to read /prometheus metrics and reach protected web and API endpoints.