CVE-2026-54546 CloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL in api/routes/basemap.ts to fetchurl without resolved-address...

CVE-2026-59277

Spring Security InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. In Spring Security 7.1.0, the internal address classification did...

Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL

Summary isPublicIP in core/providers/utils/fetch.go — the SSRF deny-list that gates FetchAndEncodeURL — does not reject several routable address ranges that map onto internal infrastructure. Carrier-Grade NAT 100.64.0.0/10, RFC 6598, IPv6 6to4 2002::/16, NAT64 64:ff9b::/96 and 64:ff9b:1::/48, and...

CVE-2026-59277

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

CVE-2026-59277

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

CVE-2026-59277 Spring Security InetAddressMatchers Incomplete Internal Network Classification

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

EUVD-2026-67169

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

CVE-2026-59277

Spring Security 7.1.0 contains a misclassification flaw in the InetAddressMatchers utility. The matchInternal() and matchExternal() builders fail to recognize the IPv4 and IPv6 any-local addresses (0.0.0.0 and :: ) as internal, causing matchExternal() to classify them as external. This enables ac...

PT-2026-82691

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Description The InetAddressMatchers utility provides matchInternal and matchExternal builders used to create an InetAddressMatcher. This component is responsible for classifying whether a provided IP address belon...

EUVD-2025-29357

Malicious code in bioql PyPI...

UBUNTU-CVE-2024-29415

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1 are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282...