Amazon Linux 2 : rclone (ALAS-2026-3947)

The version of rclone installed on the remote host is prior to 1.55.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3947 advisory. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the...

SUSE CVE-2026-67411

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopbackusers, causing th...

SUSE CVE-2026-97911

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM region size matches job It is possible for userspace to set the job SRAM size to 0, but then still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register...

GHSA-RPW4-54J3-4H4Q ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

Summary Address6.isLinkLocal recognizes fe80::/64 rather than fe80::/10. Link-local unicast is the whole /10 under RFC 4291 §2.4 and the IANA IPv6 Special-Purpose Address Registry, so the method returns false for every link-local address outside the one /64 that stateless address autoconfiguratio...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +137 more potentially affected by CVE-2026-101913 via ip-address (>=10.0.1, <=10.5.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =3.3.0, =1.5.40, =1.6.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.119 and more Source cves: CVE-2026-101913 Source advisory: OSV:GHSA-RPW4-54J3-4H4Q...

NPM: ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

NPM: ip-address: Address6.isLinkLocal recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts vulnerability discovered by ? in WordPress Npm ip-address versions = 10.5.0...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +137 more potentially affected by CVE-2026-101913 via ip-address (>=10.0.1, <=10.5.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =3.3.0, =1.5.40, =1.6.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.119 and more Source cves: CVE-2026-101913 Source advisory: GHSA-RPW4-54J3-4H4Q...

@aikidosec/broker-client (1.0.51), @app4you/n8n-nodes-portal-invoices (>=0.3.1, <=0.3.11) +42 more potentially affected by CVE-2026-101910 via ip-address (>=10.2.0, <=10.5.0)

ip-address NPM version =10.2.0, =0.3.1, =1.5.40, =1.6.0, =4.2.2, =0.17.1, =2.7.9, =4.0.3, =3.1.58, =2.6.55, =3.7.6, =2.7.130, =3.1.50, =4.0.4, =4.0.27 and more Source cves: CVE-2026-101910 Source advisory: GHSA-2VR4-CQ9G-PVRC...

@aikidosec/broker-client (1.0.51), @app4you/n8n-nodes-portal-invoices (>=0.3.1, <=0.3.11) +42 more potentially affected by CVE-2026-101910 via ip-address (>=10.2.0, <=10.5.0)

ip-address NPM version =10.2.0, =0.3.1, =1.5.40, =1.6.0, =4.2.2, =0.17.1, =2.7.9, =4.0.3, =3.1.58, =2.6.55, =3.7.6, =2.7.130, =3.1.50, =4.0.4, =4.0.27 and more Source cves: CVE-2026-101910 Source advisory: OSV:GHSA-2VR4-CQ9G-PVRC...

NPM: ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

NPM: ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass vulnerability discovered by ? in WordPress Npm ip-address versions = 10.2.0, = 10.5.0...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +143 more potentially affected by CVE-2026-101912 via ip-address (>=10.0.1, <=10.7.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =3.3.0, =1.5.40, =1.6.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.119 and more Source cves: CVE-2026-101912 Source advisory: SNYK:JS-IPADDRESS-20250962...

Improper Validation of Specified Type of Input

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via isHostInSubnet and isInSubnet which delegates to it, which compares masked...

Improper Validation of Specified Type of Input

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via isHostInSubnet and isInSubnet which delegates to it, which compares masked binary strings...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +137 more potentially affected by CVE-2026-101913 via ip-address (>=10.0.1, <=10.5.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =3.3.0, =1.5.40, =1.6.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.119 and more Source cves: CVE-2026-101913 Source advisory: SNYK:JS-IPADDRESS-20250964...

Incorrect Behavior Order

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Incorrect Behavior Order via the isLinkLocal method, which incorrectly compared only the first 64 bits of an IPv6 address against...

Incorrect Behavior Order

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Incorrect Behavior Order via the isLinkLocal method, which incorrectly compared only the first 64 bits of an IPv6 address against the fixed patte...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +143 more potentially affected by CVE-2026-101911 via ip-address (>=10.0.1, <=10.7.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =3.3.0, =1.5.40, =1.6.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.119 and more Source cves: CVE-2026-101911 Source advisory: SNYK:JS-IPADDRESS-20250983...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Address6.isValid method and the Address4 constructor when parsing an...

Allocation of Resources Without Limits or Throttling

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Address6.isValid method and the Address4 constructor when parsing an oversized input...

@aikidosec/broker-client (1.0.51), @app4you/n8n-nodes-portal-invoices (>=0.3.1, <=0.3.11) +42 more potentially affected by CVE-2026-101910 via ip-address (>=10.2.0, <=10.5.0)

ip-address NPM version =10.2.0, =0.3.1, =1.5.40, =1.6.0, =4.2.2, =0.17.1, =2.7.9, =4.0.3, =3.1.58, =2.6.55, =3.7.6, =2.7.130, =3.1.50, =4.0.4, =4.0.27 and more Source cves: CVE-2026-101910 Source advisory: SNYK:JS-IPADDRESS-20250985...