106 matches found
CVE-2026-21636
CVE-2026-21636 - Node.js 권한 모델 UDS/네트워크 우회 취약점 요약 Node.js 권한 모델--permission은 파일시스템, 자식 프로세스, 워커, 네트워크에 대한 접근을 제한하여 프로세스를 샌드박싱하도록 설계되었습니다. CVE-2026-21636 은 undici/fetch및 net/tls를 통해 Unix 도메인 소켓 과 로컬 TCP 주소로 이루어지는 연결이 --allow-net이 없더라도 네트워크 가드를 완전히 우회한다는 것을 밝혀냅니다. 영향: Node.js v25 공개 시점 기준 네트워크 권한은...
CVE-2026-84551
A logic issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. An app may be able to bypass network restrictions...
CVE-2026-78461: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-85242
A flaw was found in PlaywrightCapture. This vulnerability, known as Server-Side Request Forgery SSRF, allows an attacker to bypass network restrictions. By manipulating a favicon URL to redirect to an internal network address, an attacker can trick the PlaywrightCapture host into making requests ...
CVE-2026-70309: Origin Validation Error
Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-75583 keeper.sh Calendar version prior to 2.18.14 SSRF Guard Bypass via DNS Rebinding
keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery SSRF guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSR...
CVE-2026-75583 keeper.sh Calendar version prior to 2.18.14 SSRF Guard Bypass via DNS Rebinding
keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery SSRF guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSR...
ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification
A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery SSRF due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassificatio...
ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification
A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery SSRF due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassificatio...
CVE-2026-73210
A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...
PT-2026-70672
Name of the Vulnerable Software and Affected Versions Windows Active Directory affected versions not specified Description Inadequate encryption strength allows an authorized attacker to bypass a security feature over a network, which can lead to an impact on the system. Recommendations At the...
CVE-2026-55391
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...
CVE-2026-28945
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to bypass network restrictions...
CVE-2026-28945
A permissions issue in macOS allows an application to bypass network restrictions due to insufficient sandbox restrictions. This vulnerability is addressed in macOS Sequoia 15.7.8 , macOS Sonoma 14.8.8 , and macOS Tahoe 26.6 . While the vulnerability is confirmed as part of several security advis...
EUVD-2026-48436
9router 0.4.59 fixed in 0.4.60 contains a chain of vulnerabilities: a hardcoded default password 123456 that authenticates any fresh installation, a bypass of the LOCALONLY network gate via a spoofed Host header, and unvalidated arguments passed to childprocess.spawn when registering MCP plugins....
EUVD-2026-46424
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API http.request, http.websocket blocks requests to private network ranges to prevent server-side request forgery SSRF. This protection can be bypassed ...
dotnet: .NET: Security feature bypass due to incorrect authorization
A flaw was found in .NET where incorrect authorization allows an unauthorized attacker to bypass a security feature over a network. This vulnerability enables an attacker to circumvent intended security controls, potentially leading to unauthorized access or actions within the affected system...
EUVD-2025-210489
SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to denied network targets, enabling server-side request forgery to acce...
CVE-2026-50528
A flaw was found in .NET where incorrect authorization allows an unauthorized attacker to bypass a security feature over a network. This vulnerability enables an attacker to circumvent intended security controls, potentially leading to unauthorized access or actions within the affected system...
