CVE-2026-100355

Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. RestrictedHTTP::PrivateNetworkGuard relied on Ruby's IPAddrprivate? IPAddrloopback?, and IPAddrlinklocal? predicates plus...

PT-2026-133568

Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. RestrictedHTTP::PrivateNetworkGuard relied on Ruby's IPAddrprivate? IPAddrloopback?, and IPAddrlink local? predicates plus...

CVE-2026-100355: basecamp once-campfire: Campfire is a web-based chat application

Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. RestrictedHTTP::PrivateNetworkGuard relied on Ruby's IPAddrprivate? IPAddrloopback?, and IPAddrlinklocal? predicates plus...

CVE-2026-55787

The flyto-core execution kernel is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 2.26.3 due to an incomplete SSRF guard in src/core/utils.py. The validate_url_ssrf and is_private_ip functions fail to unwrap IPv6 transition addresses (such as IPv4-mapped , 6to4 , and NAT64 ...

CVE-2026-108115

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector baseurl,...

CVE-2026-108115 Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector baseurl,...

EUVD-2026-96339

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector baseurl,...

CVE-2026-108115 Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector baseurl,...

CVE-2026-108115 Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector baseurl,...

CVE-2026-108115

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector baseurl,...

CVE-2026-108115

Kortix Suna versions 0.10.7 before 0.13.52 are vulnerable to a Server-Side Request Forgery (SSRF) flaw. The root cause is a bypass of the isPrivateIp guard, which can be circumvented by using IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers possessing the project.conn...

PT-2026-109655

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base url...

CVE-2026-108115: Server-Side Request Forgery (SSRF)

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector baseurl,...

Kortix server-side request forgeing vulnerability

Kortix has a vulnerability related to server-side request forgery. This vulnerability arises from the isPrivateIp protection, which can be bypassed using IPv6 6to4 or Teredo addresses. An attacker with the permission of project.connector.write can set the baseurl, OpenAPI, Postman, or MCP URL of...

CVE-2026-105689 Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT...

CVE-2026-105689

The open-source design platform Penpot is vulnerable to Server-Side Request Forgery (SSRF) prior to version 2.18.0 . The root cause lies in the app.util.ssrf/blocked-address? component, which uses Java InetAddress predicates that fail to classify NAT64, 6to4, or Teredo addresses, applying CIDR ch...

CVE-2026-105689 Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT...

CVE-2026-105689 Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT...

CVE-2026-104458 YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...

CVE-2026-104458 YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...