CVE-2025-57457

OS Command Injection in CURO UC300 IP Phone An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter. PoC: https://github.com/restdone/CVE-2025-57457/blob/main/oscommandinject.mp4 Step...

CVE-2026-92395

A flaw was found in @fastify/proxy-addr. This flaw allows a remote, unauthenticated attacker to bypass access controls and security policies by spoofing client IP Internet Protocol addresses. When configured with certain IPv4-mapped IPv6 network ranges, the plugin improperly treats all incoming...

ROOT-APP-NPM-AIKIDO-2026-101201 AIKIDO-2026-101201 in proxy-addr - Patched by Root

Root has patched AIKIDO-2026-101201 in the proxy-addr package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-90711 CVE-2026-90711 in proxy-addr - Patched by Root

Root has patched CVE-2026-90711 in the proxy-addr package for Root:npm. Multiple fixed versions available...

CVE-2026-90711

A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this...

PT-2026-106681

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description A CQ pool leak occurs in the RDMA/rtrs-clt component when a connection is interrupted. The client borrows shared CQ credits in the ADDR RESOLVED handler using the ib cq pool get function...

GHSA-JQCG-44MW-7W3H proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Impact proxy-addr determines which network hops are trusted proxies so that X-Forwarded-For can be believed. When an application configures a trust subnet as an IPv4-mapped IPv6 address with a short prefix, such as ::ffff:10.0.0.0/8 the correct spelling is ::ffff:10.0.0.0/104, the subnet compiles...

EUVD-2026-78300

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet...

@42mo/42mo-web-styles (>=0.0.16, <=0.0.30), @aconex/styleguide (>=2.0.1, <=2.2.0) +1692 more potentially affected by CVE-2026-90711 via proxy-addr (>=1.1.2, <=2.0.7)

proxy-addr NPM version =1.1.2, =0.0.16, =2.0.1, =1.1.0, =0.3.1, =6.1.3, =1.0.0, =1.0.0, =0.0.0, =0.7.15, =0.17.5, =0.17.6-rc.1 and more Source cves: CVE-2026-90711 Source advisory: OSV:GHSA-JQCG-44MW-7W3H...

NPM: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

NPM: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet vulnerability discovered by ? in WordPress Npm proxy-addr versions = 1.1.0, 2.0.8...

@42mo/42mo-web-styles (>=0.0.16, <=0.0.30), @aconex/styleguide (>=2.0.1, <=2.2.0) +1692 more potentially affected by CVE-2026-90711 via proxy-addr (>=1.1.2, <=2.0.7)

proxy-addr NPM version =1.1.2, =0.0.16, =2.0.1, =1.1.0, =0.3.1, =6.1.3, =1.0.0, =1.0.0, =0.0.0, =0.7.15, =0.17.5, =0.17.6-rc.1 and more Source cves: CVE-2026-90711 Source advisory: GHSA-JQCG-44MW-7W3H...

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Impact proxy-addr determines which network hops are trusted proxies so that X-Forwarded-For can be believed. When an application configures a trust subnet as an IPv4-mapped IPv6 address with a short prefix, such as ::ffff:10.0.0.0/8 the correct spelling is ::ffff:10.0.0.0/104, the subnet compiles...

Malicious code in css-gap-decorations-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8126656cc344a4f632b8ddf5a23683fc92ac22798bb67e1aed6bca73ac82d7b6 The package is published as a CSS polyfill but ships no polyfill functionality. On require, thunderboltRegistry.js uses childprocess.execSync to run...

CLEANSTART-2026-CT50806 proxy-addr is a Node

Security vulnerability affects the argo-workflows package. proxy-addr is a Node...

CVE-2026-102365

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal...

CVE-2026-102365: Missing Authorization

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal...

PT-2026-108377

Security vulnerability affects the argo-workflows package. proxy-addr is a Node...

CVE-2026-102365 mall4j through 4.0 Missing Authorization in Admin User Address Endpoints

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal...

CVE-2026-102365 mall4j through 4.0 Missing Authorization in Admin User Address Endpoints

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal...

PT-2026-102408

Name of the Vulnerable Software and Affected Versions mall4j versions prior to 4.1 Description The software fails to enforce authorization checks on GET endpoints within the UserAddrController used to retrieve customer address data. Authenticated attackers can access the '/user/addr/page' and...