CVE-2026-48736 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATESUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowi...

EUVD-2024-25703

Malicious code in bioql PyPI...

CVE-2024-28607

The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses such as 0x7f.1 are improperly categorized as globally routable via a falsy isPrivate return value...

CVE-2024-28607

The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses such as 0x7f.1 are improperly categorized as globally routable via a falsy isPrivate return value...

CVE-2024-28607

The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses such as 0x7f.1 are improperly categorized as globally routable via a falsy isPrivate return value...

CVE-2024-28607

The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses such as 0x7f.1 are improperly categorized as globally routable via a falsy isPrivate return value...

CVE-2024-28607

CVE-2024-28607 affects the ip-utils package for Node.js up to version 2.4.0. The root cause is a faulty isPrivate check that can misclassify certain IPs (e.g., 0x7f.1) as globally routable, enabling SSRF. Documented impacts are SSRF risk; no explicit remediation or patch/version guidance is prese...

CVE-2024-28607

The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses such as 0x7f.1 are improperly categorized as globally routable via a falsy isPrivate return value...

@fonoster/apiserver (>=0.6.1-alpha.0, <=0.30.0), @fonoster/sipnet (>=0.6.1-alpha.0, <=0.30.0) +18 more potentially affected by CVE-2024-28607 via ip-utils (2.4.0)

ip-utils NPM version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on ip-utils and may be impacted: - @fonoster/apiserver =0.6.1-alpha.0, =0.6.1-alpha.0, =2.0.5-alpha.7, =2.0.5-alpha.3, =2.0.8-alpha.21, =2.0.5-alpha.2, =2.0.3, =2.0.8-alpha.13,...

CVE-2024-28607

The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses such as 0x7f.1 are improperly categorized as globally routable via a falsy isPrivate return value...

CVE-2024-28607: Incorrect Behavior Order: Validate Before Canonicalize

The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses such as 0x7f.1 are improperly categorized as globally routable via a falsy isPrivate return value...

PT-2025-10717

Name of the Vulnerable Software and Affected Versions ip-utils versions prior to 2.4.0 Description The issue concerns the ip-utils package, which might allow Server-Side Request Forgery SSRF due to improper categorization of certain IP addresses as globally routable. This occurs because some IP...