CVE-2026-101913 ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can...

CVE-2026-101913

The ip-address JavaScript library, used for parsing and manipulating IPv4 and IPv6 addresses, contains a vulnerability in the Address6.isLinkLocal method within src/ipv6.ts in versions prior to 10.5.1 . The method incorrectly recognizes only the fe80::/64 prefix instead of the full fe80::/10 IPv6...

CVE-2026-101910

The ip-address JavaScript library (versions 10.2.0 through 10.5.1 ) contains a logic flaw in the Address6 isPrivate classifier located in src/ipv6.ts. Specifically, it fails to recognize the NAT64 local-use range 64:ff9b:1::/48. This allows applications that rely on isPrivate, isLoopback, and isL...

CVE-2026-101910 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

CVE-2026-101910 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

EUVD-2026-88394

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

CVE-2026-101910 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

CVE-2023-54397

A flaw was found in Tornado's HTTP request header parsing logic. When processing incoming HTTP requests, Tornado fails to reject malformed Content-Length headers containing non-standard characters. An unauthenticated remote attacker can exploit this parsing discrepancy when Tornado is deployed...

CVE-2026-101913: Incorrect Comparison

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can...

CVE-2026-101059 utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the librar...

CVE-2026-101059 utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the librar...

CVE-2026-101059

The utcp-http library, in versions before 1.1.4 , is vulnerable to a Trust Boundary Bypass involving the OAuth2 tokenUrl field. The library fails to validate this field when it is sourced from remote OpenAPI specifications . An attacker can exploit this by providing a malicious OpenAPI specificat...

Incorrect Authorization

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Incorrect Authorization via LegacyResolver.isPathAllowed in lib/resolver-compat.js, which uses a raw path.startsWithmod.path check to authorize modul...

CVE-2026-100837

Contrast Edgeless Systems through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffixhostname, fqdn without requiring a DNS label boundary, so a registry entry such...

CVE-2026-100634

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

EUVD-2026-87728

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

CVE-2026-100532

@openclaw/whatsapp npm before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login an...

EUVD-2026-87518

@openclaw/whatsapp npm before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login an...

CVE-2026-100532 openclaw WhatsApp before 2026.8.1 Authentication Bypass

@openclaw/whatsapp npm before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login an...

PT-2026-99169

Name of the Vulnerable Software and Affected Versions @openclaw/whatsapp versions prior to 2026.8.1 Description The software exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, failing to enforce the owner-only tool...