CVE-2026-58683

A vulnerability exists in the IP Multimedia Subsystem of Pixel devices due to an out-of-bounds write caused by improper input validation. This flaw could allow an attacker to achieve remote code execution (RCE) without requiring additional execution privileges or user interaction. The issue is sp...

CVE-2026-58683

In IP Multimedia Subsystem, there is a possible out-of-bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55366

In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55366

A logic error in the IP Multimedia Subsystem code allows for a possible authentication bypass . This vulnerability could lead to remote escalation of privilege without requiring additional execution privileges or user interaction. No specific affected versions or remediation details are provided ...

EUVD-2026-78954

In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55366

In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55331

In IP Multimedia Subsystem, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55331

In IP Multimedia Subsystem, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55331

A high-severity Remote Code Execution (RCE) vulnerability exists in the IP Multimedia Subsystem (Telephony) due to an out-of-bounds write caused by an incorrect bounds check. This flaw allows an attacker to execute arbitrary code without requiring additional execution privileges or user interacti...

EUVD-2026-78948

In IP Multimedia Subsystem, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-91997

evolution-api through version 2.3.7 contains a Prometheus metrics IP allowlist bypass . The root cause is an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, effectively disabling the IP whitelist. This allows unauthenticated remote attackers to acce...

CVE-2026-91997 evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...

EUVD-2026-78437

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...

CVE-2026-91997 evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...

AZL-101775 CVE-2026-90711 affecting package python-tensorboard 2.16.2-6

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

DEBIAN-CVE-2026-90711

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as ::ffff:10.0.0.0/8 compiles with all-zero leading bits and matches every address rather than the intended block. An attack...

CVE-2026-90711 proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-90711 proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-90711 proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...