CVE-2026-21636

CVE-2026-21636 - Node.js Permission Model UDS/Network Bypass Vulnerability summary The Node.js permission model --permission is designed to sandbox a process by restricting access to the filesystem, child processes, workers, and network. CVE-2026-21636 reveals that connections made via undici/fet...

PT-2026-115845

When migrations ALLOWED DOMAINS was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or...

CVE-2026-96957

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-96238

Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network...

UBUNTU-CVE-2026-70194

Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-113156

Name of the Vulnerable Software and Affected Versions .NET affected versions not specified Description Improper verification of cryptographic signatures allows an unauthorized attacker to bypass a security feature over a network. Recommendations At the moment, there is no information about a newe...

CVE-2026-70005: Weak Authentication

Weak authentication in Active Directory Federation Services AD FS allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-69982: Weak Authentication

Weak authentication in Active Directory Federation Services AD FS allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-85922: Weak Authentication

Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network...

UBUNTU-CVE-2026-96957

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-96957: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network...

EUVD-2026-93908

When migrations ALLOWEDDOMAINS was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or...

CVE-2026-84551

A logic issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. An app may be able to bypass network restrictions...

CVE-2026-78461: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-85242

A flaw was found in PlaywrightCapture. This vulnerability, known as Server-Side Request Forgery SSRF, allows an attacker to bypass network restrictions. By manipulating a favicon URL to redirect to an internal network address, an attacker can trick the PlaywrightCapture host into making requests ...

CVE-2026-70309: Origin Validation Error

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-75583 keeper.sh Calendar version prior to 2.18.14 SSRF Guard Bypass via DNS Rebinding

keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery SSRF guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSR...

CVE-2026-75583 keeper.sh Calendar version prior to 2.18.14 SSRF Guard Bypass via DNS Rebinding

keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery SSRF guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSR...

ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification

A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery SSRF due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassificatio...

ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification

A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery SSRF due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassificatio...