@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +143 more potentially affected by CVE-2026-101912 via ip-address (>=10.0.1, <=10.7.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =3.3.0, =1.5.40, =1.6.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.119 and more Source cves: CVE-2026-101912 Source advisory: OSV:GHSA-J6R3-76F7-8JCV...

NPM: ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

NPM: ip-address: isInSubnet and isHostInSubnet compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range vulnerability discovered by ? in WordPress Npm ip-address versions = 10.7.0...

NPM: ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

NPM: ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process vulnerability discovered by ? in WordPress Npm ip-address versions = 10.7.0...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +143 more potentially affected by CVE-2026-101911 via ip-address (>=10.0.1, <=10.7.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =3.3.0, =1.5.40, =1.6.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.119 and more Source cves: CVE-2026-101911 Source advisory: GHSA-H3MG-XC3C-68PW...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +143 more potentially affected by CVE-2026-101911 via ip-address (>=10.0.1, <=10.7.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =3.3.0, =1.5.40, =1.6.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.119 and more Source cves: CVE-2026-101911 Source advisory: OSV:GHSA-H3MG-XC3C-68PW...

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

Summary new Address6 and Address6.isValid place no bound on the length of the string they parse. When the string contains a character that cannot appear in an IPv6 address, the parser builds a diagnostic that wraps every such character in a 34-byte , so the work and the memory scale with the inpu...

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string. For example: text "user"@example.comxevil.com is parsed as: text address: "[email protected] evil.com", name: "" The...

GHSA-G57G-F23G-4646 Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string. For example: text "user"@example.comxevil.com is parsed as: text address: "[email protected] evil.com", name: "" The...

SUSE CVE-2026-100820

Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17...

SUSE CVE-2026-101910

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

SUSE CVE-2026-101911

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through REBADCHARACTERS into large diagnostics. Material...

SUSE CVE-2026-101912

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

SUSE CVE-2026-101913

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can...

CVE-2026-102879

ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the downloadfile and scrapeweb agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata...

CVE-2026-102312

UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-102312

UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: High...

CVE-2026-102879 ClaraVerse through 0.3.1 SSRF Protection Bypass

ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the downloadfile and scrapeweb agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata...

EUVD-2026-89414

ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the downloadfile and scrapeweb agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata...

CVE-2026-102879 ClaraVerse through 0.3.1 SSRF Protection Bypass

ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the downloadfile and scrapeweb agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata...

CVE-2026-102312

UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: High...