EUVD-2026-75184

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch...

CVE-2026-88896

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

CVE-2026-88896

EspoCRM before 10.0.4 is vulnerable to Server-Side Request Forgery (SSRF) via an IPv6 transition address bypass in HostCheck::ipAddressIsNotInternal(). The function strips ::ffff: (IPv4-mapped IPv6) prefixes but fails to recognize IPv6 transition addresses that embed private IPv4 addresses—NAT64 ...

EUVD-2026-75446

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

CVE-2026-88896 EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

CVE-2026-88896 EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

Summarypraisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhookURLs by resolving the hostname and checking whether the IP is private. When DNSresolution fails socket.gaierror, the validator silently passes the URL viaexcept socket.gaierror: pass. Additionally, even when DNS...

Malicious code in etoro-cashout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...

MAL-2026-16117 Malicious code in etoro-cashout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...

Malicious code in etoro-charts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44aff5a1a0b68ff9c9b3456693ef1b8266dce7001dd8b6ff56bed428bbc7c5a On npm install, preinstall.js runs automatically and sends the installer's hostname, username, platform, and current working directory via HTTP GET t...

Exploit for CVE-2026-72815

CVE-2026-72815: go-chi/chi middleware.RealIP IP Spoofing PoC...

CVE-2026-45762: Access of Resource Using Incompatible Type

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker used the same IP address family as the packet being...

Outbound Public IP Addresses Used by Veeam Data Cloud

Purpose This article lists the outbound public IP addresses that Veeam Data Cloud uses when connecting from the cloud to infrastructure that a customer hosts and controls, for example a Microsoft Azure Key Vault used for BYOK encryption. These addresses are not used for inbound connections made t...

PT-2026-89407

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

unimap v0.8.0

Unimap Scan only once by IP address and reduce scan times with Nmap for large amounts of data. Unimap is an abbreviation of "Unique Nmap Scan ". The tool can run in Linux, OSX, Windows or Android Termux without problems. Why? If you have plans to run a Nmap to a whole organization you need to...

CVE-2026-87999

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...

CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...

Security Bulletin: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

Summary Upgrade to InformixHQ 3.3.2 Vulnerability Details CVEID:CVE-2026-69192 DESCRIPTION: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATW...

Security Bulletin: vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses.

Summary Upgrade to InformixHQ 3.3.2 Vulnerability Details CVEID:CVE-2026-54272 DESCRIPTION: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6...

K000163266: QEMU virtio-blk vulnerability CVE-2026-48914

Security Advisory Description A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-bl...