WordPress Contact Form by Supsystic plugin <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header vulnerability

Unauthenticated Stored Cross-Site Scripting via IP Address Header vulnerability discovered by andrea bocchetti in WordPress Plugin Contact Form by Supsystic versions = 1.10.2...

PT-2026-95039

TuxCare rebuilt ip-address to address 2 CVEs. Fixed in 6.4.0-tuxcare.2...

CLSA-2026-1788560487 TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 6.4.0-tuxcare.1...

Incorrect Remote IP Address Evaluation

Reactor Netty is vulnerable to an Incorrect Remote IP Address Evaluation. The vulnerability is due to improper evaluation of the remote IP address when the HAProxy Protocol is enabled, which may allow an attacker to spoof or manipulate the perceived client IP address under specific configurations...

IP Address Disclosure

Spring Security is vulnerable to IP address disclosure. The vulnerability is due to improper IP classification logic in the InetAddressMatchers utility, where the matchInternal and matchExternal builders can be manipulated to incorrectly classify private IP addresses as public, allowing an attack...

PT-2026-91824

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 6.4.0-tuxcare.1...

ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification

A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery SSRF due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassificatio...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

CVE-2024-35585

Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication...

CVE-2024-35585: Missing Authentication for Critical Function

Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication...

CVE-2024-35585

Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication...

AlmaLinux 9 : nodejs:24 (ALSA-2026:55603)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55603 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...

CVE-2026-101910

creationtimestamp| type| source ---|---|--- 2026-08-29 03:32:59+00:00| published-proof-of-concept| https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc 2026-09-29 06:30:30+00:00| seen| https://gist.github.com/alon710/d44db51e720dfe6d0e35e26eb2a0926c 2026-09-29...

CVE-2026-101913

creationtimestamp| type| source ---|---|--- 2026-08-29 03:32:55+00:00| published-proof-of-concept| https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q 2026-09-29 12:01:24+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwnrskjnxm2v...

CVE-2026-59277 Spring Security InetAddressMatchers Incomplete Internal Network Classification

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

CVE-2026-47845

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

CVE-2026-47845: Authentication Bypass by Spoofing

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

PT-2026-82543

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ip address parameter is embedded...

CVE-2026-47845

Reactor Netty HTTP Server may incorrectly evaluate the remote IP address in specific scenarios when the HAProxy Protocol is enabled, allowing a client to spoof the reported source address. Affected versions are 1.3.0–1.3.6 , 1.1.0–1.2.18 , and 1.0.52 and earlier . The vulnerability is rated CVSS ...

CVE-2026-47845 Reactor Netty HTTP Server may incorrectly evaluate proxy addresses

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...