CVE-2026-101911

The ip-address JavaScript library (versions prior to 10.7.1 ) is vulnerable to a Denial of Service (DoS) condition. The Address6 constructor , Address6.isValid , and the parse code in src/ipv6.ts accept unbounded strings and expand invalid characters via RE_BAD_CHARACTERS into large diagnostics. ...

CVE-2026-101911 ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through REBADCHARACTERS into large diagnostics. Material...

CVE-2026-101910

The ip-address JavaScript library (versions 10.2.0 through 10.5.1 ) contains a logic flaw in the Address6 isPrivate classifier located in src/ipv6.ts. Specifically, it fails to recognize the NAT64 local-use range 64:ff9b:1::/48. This allows applications that rely on isPrivate, isLoopback, and isL...

CVE-2026-101910 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

CVE-2026-101910 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

CVE-2026-101910 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

CVE-2026-101078

A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be...

CVE-2026-101078

A vulnerability exists in deepseek-ai deepseek-harness versions up to 0.1.7-rc.2 within the Landlock Backend component. The issue stems from an unknown function in the file packages/sandbox/sandbox-local/src/profiles.ts, which can lead to improper isolation or compartmentalization . Exploitation ...

EUVD-2026-88334

A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be...

CVE-2026-101078 deepseek-ai deepseek-harness Landlock Backend profiles.ts isolation

A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be...

CVE-2026-101078 deepseek-ai deepseek-harness Landlock Backend profiles.ts isolation

A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be...

CVE-2026-91154

The MarcosCamara01 Ecommerce Template (before commit ec97209 ) is vulnerable to a Missing Authentication for Critical Function (CWE-306) within the revalidateProducts Server Action located in src/app/actions.ts. Because the file uses a "use server" scope without session or role checks, the revali...

CVE-2026-101068 dbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversal

A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packages/api/src/utility/zipJsonLinesData.js of the component Create Connection Endpoint. Performing a manipulation of the argument filePath results in path traversal. Remote...

EUVD-2026-88217

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...

CVE-2026-101052 refly-ai refly JWT Token app.config.ts hard-coded credentials

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...

CVE-2026-101052 refly-ai refly JWT Token app.config.ts hard-coded credentials

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...

EUVD-2026-88198

A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The exploit has been disclosed to the public...

CVE-2026-100893 Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function opengraph::fetch of the file src/api/resource.rs of the component opengraphicparse Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. The...

CVE-2026-100893 Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function opengraph::fetch of the file src/api/resource.rs of the component opengraphicparse Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. The...

EUVD-2026-88057

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function opengraph::fetch of the file src/api/resource.rs of the component opengraphicparse Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. The...