1808 matches found
CVE-2026-82476: Server-Side Request Forgery (SSRF)
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read...
CVE-2026-55245 Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL
Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16,...
PT-2026-82964
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the netfilter module, the xt nat SNAT and DNAT target handlers assume that IP-family conntrack state is present. When instantiated from an unsupported family through nft compat, such ...
kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
A flaw was found in the Linux kernel's netfilter conntrack TCP state machine. A remote attacker can exploit this vulnerability by sending a specially crafted sequence of TCP Transmission Control Protocol packets, specifically a SYN synchronize packet followed by an RST reset packet with an invali...
kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
A flaw was found in the Linux kernel's netfilter conntrack TCP state machine. A remote attacker can exploit this vulnerability by sending a specially crafted sequence of TCP Transmission Control Protocol packets, specifically a SYN synchronize packet followed by an RST reset packet with an invali...
PT-2026-82127
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ipvs module where the system fails to revalidate embedded headers after reading them from the skb frags. A local process can modify the ihl field, which, following...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098737)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098737 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: add seqadj extension for natted connections Sequence adjustment may be required...
The vulnerability of the xfrm_nat_keepalive_net_init() function in the net/xfrm/xfrm_nat_keepalive.c module, which implements networking functions for the Linux kernel, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the xfrmnatkeepalivenetinit function in the net/xfrm/xfrmnatkeepalive.c module, which implements networking functions in the Linux kernel, is related to state management errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity...
CVE-2026-78205
BentoML's outbound connection safeguard makesafeconnect in internal/utils/uri.py blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space 100.64.0.0/10, CGNAT. In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointin...
CVE-2026-74724
In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ipvsnaticmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such...
PT-2026-79729
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPVS IP Virtual Server component where a local attacker can modify a packet during processing. The system reads the IP ihl Internet Header Length field multiple...
CVE-2026-75501
Rejected reason: Vendor could not replicate the vul, and reporter is unavailable to comment...
CVE-2026-75501
...
EUVD-2026-63988
A vulnerability in the Calix EXOS firmware for the GS7 XGS GS5239XG residential router allows unauthenticated remote attackers to modify NAT port‑forwarding rules via the UPnP WANIPConnection service. The device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without...
PT-2026-79389
Name of the Vulnerable Software and Affected Versions Calix EXOS firmware version 6.6.47 Description An issue in the Calix EXOS firmware for the GS7 XGS GS5239XG residential router allows unauthenticated remote attackers to modify NAT port-forwarding rules. The device exposes the MiniUPnPd contro...
Retraction of "Calix GS7 XGS GS5239XG residential router contains missing authentication vulnerability"
Overview The Calix GS7 XGS GS5239XG router running firmware EXOS/6.6.47 contains a missing authentication vulnerability that exposes its UPnP Universal Plug and Play WANIPConnection service on the public WAN interface After further analysis of the case alongside the Calix security team, we have...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102079)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102079 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: destroy stale expectfn expectations on unregister NAT helpers such as...
CVE-2026-49420 Buffer overflow in libalias RTSP handler
The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a...
CVE-2026-49420 Buffer overflow in libalias RTSP handler
The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a...