357 matches found
CVE-2026-122140
The software Trawl versions 1.5.0 before 1.10.0 is vulnerable to a Server-Side Request Forgery (SSRF) . This vulnerability allows unauthenticated attackers to bypass the MCP outbound URL policy by utilizing IPv4-mapped IPv6 addresses . Attackers can provide hex-normalized addresses (e.g., ::ffff:...
EUVD-2026-117094
Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 directly or via redirects to fetch loopback...
CLEANSTART-2026-JI73434 various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms
Security vulnerability affects the argo-workflows package. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...
CLEANSTART-2026-DM01376 various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms
CVE-2024-24790 affects multiple packages. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. See references for individual vulnerability details...
Security Bulletin: Vulnerability in prox-addr Node.js module
Summary Vulnerability in prox-addr Node.js module Vulnerability Details CVEID:CVE-2026-90711 DESCRIPTION: proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust...
CVE-2026-115729 @pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, ::, NAT64 or localhost alias hostnames to read loopback, internal o...
proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this...
CVE-2026-111171
Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because checkipblocked does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA record...
CVE-2026-111171 Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass
Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because checkipblocked does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA record...
CVE-2026-111171
Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because checkipblocked does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA record...
CVE-2026-111171
The Web3.py library versions 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The root cause is that the _check_ip_blocked() function fails to unwrap IPv4-mapped IPv6 addresses during CCIP Read URL validation . An attacker can u...
EUVD-2026-102298
Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because checkipblocked does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA record...
CVE-2026-111171 Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass
Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because checkipblocked does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA record...
CVE-2026-111171: Server-Side Request Forgery (SSRF)
Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because checkipblocked does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA record...
PT-2026-115177
Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because check ip blocked does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA...
Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Authentication Bypass.
Summary proxy-addr is used by IBM Storage Fusion Data Foundation, which could cause Authentication Bypass. CVE-2026-90711. Vulnerability Details CVEID:CVE-2026-90711 DESCRIPTION: proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs...
CVE-2026-90711
A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this...
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
Impact proxy-addr determines which network hops are trusted proxies so that X-Forwarded-For can be believed. When an application configures a trust subnet as an IPv4-mapped IPv6 address with a short prefix, such as ::ffff:10.0.0.0/8 the correct spelling is ::ffff:10.0.0.0/104, the subnet compiles...
NPM: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
NPM: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet vulnerability discovered by ? in WordPress Npm proxy-addr versions = 1.1.0, 2.0.8...