PT-2026-99956

Name of the Vulnerable Software and Affected Versions ip-address versions prior to 10.5.1 Description The Address6.isLinkLocal method in src/ipv6.ts incorrectly recognizes only the fe80::/64 range instead of the full fe80::/10 IPv6 link-local range. This creates an inconsistency where the same...

CVE-2026-101912: Incorrect Comparison

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

PT-2026-99955

Name of the Vulnerable Software and Affected Versions ip-address versions prior to 10.7.1 Description The isInSubnet and isHostInSubnet functions in src/common.ts compare masked binary strings without verifying if both operands belong to the same IP family. This allows a cross-family containment...

CVE-2026-80514

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

CVE-2026-80514: Use of Less Trusted Source

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

CVE-2026-14321

The divi-dash WordPress plugin, versions prior to 1.0.7 , is vulnerable to an unauthenticated Denial of Service due to insufficient validation of client IP addresses used for rate limiting and banning. An attacker can spoof arbitrary IP addresses to bypass these security measures, ban legitimate ...

CVE-2026-14321 Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...

CVE-2026-14321 Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...

EUVD-2026-85020

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...

CVE-2026-87070: Use of Less Trusted Source

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry...

CLSA-2026-1790006158 TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 6.4.0-tuxcare.3...

PT-2026-105284

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 6.4.0-tuxcare.3...

CVE-2026-82759 Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that the audit log add-on's :hash privacy mode is meant to pseudonymise. AshAuthentication.AddOn.AuditLog.IpPrivacy.haship/1 computes ...

CVE-2026-82759: Use of a One-Way Hash with a Predictable Salt

Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that the audit log add-on's :hash privacy mode is meant to pseudonymise. AshAuthentication.AddOn.AuditLog.IpPrivacy.haship/1 computes ...

CVE-2026-101912

creationtimestamp| type| source ---|---|--- 2026-09-15 04:15:05+00:00| published-proof-of-concept| https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv 2026-09-30 04:30:31+00:00| seen| https://gist.github.com/alon710/695037b527e98708f813a603aa97604e 2026-09-30...

CVE-2026-101911

creationtimestamp| type| source ---|---|--- 2026-09-15 04:15:03+00:00| published-proof-of-concept| https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw 2026-09-30 05:30:30+00:00| seen| https://gist.github.com/alon710/8432dbe3939654e0587f7004c91b9879 2026-09-30...

CVE-2026-65355

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2026-65352

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2026-65355

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2026-65355

An information disclosure issue in Authentication Services and WebKit was addressed with improved state management across multiple Apple products. This vulnerability allowed a website to determine a user's IP address even when Private Relay was enabled. The issue is fixed in iOS 18.7.10 , iPadOS ...