netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation

A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended...

axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization

A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NOPROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the...

CVE-2026-88896

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

EUVD-2026-75446

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

CVE-2026-88896

EspoCRM before 10.0.4 is vulnerable to Server-Side Request Forgery (SSRF) via an IPv6 transition address bypass in HostCheck::ipAddressIsNotInternal(). The function strips ::ffff: (IPv4-mapped IPv6) prefixes but fails to recognize IPv6 transition addresses that embed private IPv4 addresses—NAT64 ...

CVE-2026-88896 EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-22007-NTP-monlist-Amplification-over-IPv6

CVE-2026-22007 – NTP monlist Amplification over IPv6 Program Code Python root@kitploit: ntpamplifysim.py - NTP server responding to monlist without authentication import socket, struct def ntpmonlistresponse: Simplified NTP reply with many entries return b'\x00' 1200 large response server =...

CVE-2026-33827

🔴 CVE-2026-33827: Windows TCP/IP Remote Code Execution RCE 📌 General Description CVE-2026-33827 is a critical Remote Code Execution RCE vulnerability affecting the Windows TCP/IP network stack. It is classified as a Race Condition flaw caused by improper synchronization when handling shared...

kernel: ipv6: prevent possible UaF in addrconf_permanent_addr()

A flaw was found in the Linux kernel's IPv6 networking subsystem. Specifically, a Use-after-Free UaF vulnerability exists within the addrconfpermanentaddr function. This issue arises when the system attempts to access an IPv6 address after it has been freed, which could allow an attacker to cause...

kernel: ipv6: mcast: Fix use-after-free when processing MLD queries

A flaw was found in the Linux kernel's IPv6 multicast mcast component. When processing Multicast Listener Discovery MLD queries, a pointer to the multicast group address is not correctly reloaded after certain packet manipulations. This can lead to a use-after-free vulnerability, potentially...

PT-2026-89407

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

CVE-2026-26988-LibreNMS-SQLi

CVE-2026-26988 – LibreNMS Unauthenticated SQL Injection PoC Unauthenticated SQL Injection in LibreNMS ajaxtable.php via IPv6 address search parameter. Affected versions : LibreNMS ≤ 25.12.0 Fixed in : LibreNMS ≥ 26.1 commit 15429580baba03ed1dd377bada1bde4b7a1175a1...

enyx

enyx SNMP IPV6 Enumerator Tool - n3rdh4x0r -...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

quick-fix-cve-2024-38063

quick-fix-cve-2024-38063 quick powershell script to fix cve-2024-38063 Donation if you want to support my works, you can donate me at the following monero address: root@kitploit: 4B9WQivaHfd3miDfPKEfCianocGpBx9d8FXycz2vmNW3aBDVKHgkBd9Gmapt4RBVEpTwnehujsiUBBehUiLvnEHs7VFstCC Or using PayPal:...

CVE-2024-38063

This is a rather flaky poc for CVE-2024-38063, a RCE in tcpip.sys patched on August 13th 2024. I didn't find and report this vuln, that would be Wei. requirements root@kitploit: pip3 install scapy usage Modify the fields in the script: iface - If you have multiple adapters, you need to choose...

terraform-aws-security-group

terraform-aws-security-group Terraform module to manage AWS Security Groups. Currently, the ingress and egress rules support IPv4, IPv6, and Security Group ID inputs. Requirements...

kernel: ipv6: fix possible UAF in icmpv6_rcv()

A flaw was found in the Linux kernel's IPv6 Internet Protocol version 6 implementation. This vulnerability, a Use-After-Free UAF error, occurs due to incorrect caching of network packet addresses before a memory operation. An attacker could potentially exploit this flaw to cause memory corruption...

kernel: ipv6: fix possible UAF in icmpv6_rcv()

A flaw was found in the Linux kernel's IPv6 Internet Protocol version 6 implementation. This vulnerability, a Use-After-Free UAF error, occurs due to incorrect caching of network packet addresses before a memory operation. An attacker could potentially exploit this flaw to cause memory corruption...