Lucene search
+L

94246 matches found

EUVD
EUVD
added 2026/08/03 8:15 p.m.11 views

EUVD-2026-52427

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public...

5.3CVSS5.6AI score0.00243EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/03 8:15 p.m.48 views

CVE-2026-18736 Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public...

5.3CVSS0.00243EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/03 8:15 p.m.40 views

CVE-2026-18736

Technical details about CVE-2026-18736 are not publicly available in the provided documents. Monitor for updates for affected products, versions, impact specifics, and remediation guidance.

5.3CVSS5.6AI score0.00243EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/03 8:15 p.m.15 views

CVE-2026-18736 Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public...

5.3CVSS5.6AI score
SaveExploits0References5
Patchstack
Patchstack
added 2026/08/03 7:59 p.m.13 views

NPM: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

NPM: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass vulnerability discovered by ? in WordPress Npm ip-address versions = 10.3.0...

7.7CVSS5.4AI score0.00366EPSS
SaveExploits0References4Affected Software1
OSV
OSV
added 2026/08/03 7:59 p.m.21 views

GHSA-MWP4-54F8-5FHR ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

Summary Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inetaton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4'012.0.0.1'...

7.7CVSS5.7AI score0.00366EPSS
SaveExploits0References4
Snyk
Snyk
added 2026/08/03 7:59 p.m.9 views

Server-side Request Forgery (SSRF)

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through improper handling of IPv4 addresses with leading zeros in the Address4. An attacker can bypass network...

8.6CVSS5.5AI score0.00366EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/03 7:59 p.m.8 views

GHSA-4XRF-JV44-H6HH ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

Summary Every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses...

6.9CVSS5.5AI score0.00346EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/03 7:59 p.m.23 views

CVE-2026-69198 ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

6.9CVSS5.6AI score
SaveExploits0References5
CVE
CVE
added 2026/08/03 7:59 p.m.80 views

CVE-2026-69198

The CVE affects the ip-address JavaScript library (versions 10.1.1–10.2.2). A defect in the containment guard in classification (built on isInSubnet) makes special-use checks (isLoopback, isPrivate, isLinkLocal, isCGNAT, isMulticast, isUnspecified, isBroadcast, isULA, getType) return an internal ...

6.9CVSS5.6AI score0.00346EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/03 7:59 p.m.57 views

CVE-2026-69198 ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

6.9CVSS0.00346EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/08/03 7:59 p.m.7 views

CVE-2026-69198 ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

6.9CVSS5.5AI score0.00346EPSS
SaveExploits0References3
Debian CVE
Debian CVE
added 2026/08/03 7:56 p.m.14 views

CVE-2026-69192

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inetaton, and getaddrinfo all decode a leading zero as octal. The library...

7.7CVSS5.6AI score0.00366EPSS
SaveExploits0
Vulnrichment
Vulnrichment
added 2026/08/03 7:56 p.m.7 views

CVE-2026-69192 ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inetaton, and getaddrinfo all decode a leading zero as octal. The library...

7.7CVSS5.6AI score0.00366EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/03 7:52 p.m.11 views

GHSA-22JQ-VG5J-6VGG ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

Summary Address6's special-property checks misclassify IPv4-mapped ::ffff:0:0/96 and NAT64 well-known 64:ff9b::/96 IPv6 addresses. These checks classify an address by its IPv6 wrapper rather than by the IPv4 address it embeds, so isLoopback, isLinkLocal, isMulticast, and isUnspecified all return...

6.9CVSS5.5AI score0.0035EPSS
SaveExploits0References5
OSV
OSV
added 2026/08/03 7:08 p.m.8 views

JLSEC-2026-1144 Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the...

Issue summary: The implementations of AES-SIV RFC 5297 and AES-GCM-SIV RFC 8452 mishandle the authentication of AAD Additional Authenticated Data with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's...

4.8CVSS7.4AI score0.00374EPSS
SaveExploits0References13
ATTACKERKB
ATTACKERKB
added 2026/08/03 7:05 p.m.11 views

CVE-2026-48031

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

9.1CVSS7.7AI score0.00346EPSS
SaveExploits0References4Affected Software1
Cvelist
Cvelist
added 2026/08/03 7:05 p.m.45 views

CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

9.1CVSS0.00346EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/03 7:05 p.m.93 views

CVE-2026-48031

Technical details about CVE-2026-48031 are not publicly provided in the supplied documents. The go-base JWT-secret issue is described at a high level; monitor for updates for concrete affected versions, root cause, and fixes.

9.1CVSS7.7AI score0.00346EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/08/03 7:05 p.m.9 views

CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

9.1CVSS7.7AI score0.00346EPSS
SaveExploits0References3
Rows per page
Query Builder