CVE-2026-92395 @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as...

CVE-2026-92395 @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as...

ZeroTrace

ZeroTrace ZeroTrace is a powerful ethical hacking tool for anonymization, developed in Bash. It helps you stay anonymous online by routing all of your system’s network traffic—not just browser traffic—through the Tor network. As a result, tracking your online activity, IP address, and location...

CVE-2026-86107

The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and...

CVE-2026-86107 Security Advisory 0180

The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and...

EUVD-2026-80658

The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and...

CVE-2026-86107 Security Advisory 0180

The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and...

CVE-2026-86107

CVE-2026-86107 is an out-of-bounds write (CWE-787) in the VeloCloud VCMP tunnel protocol on VeloCloud Edge and VeloCloud Gateway (formerly Broadcom). When processing tunneled IP fragments between authenticated overlay neighbors , a malicious peer can trigger a process crash, causing temporary tra...

CVE-2026-89949

CVE-2026-89949 affects the Linux kernel 's batman-adv module, specifically the DAT (Distributed ARP Table) component. When extracting IP addresses from ARP packets, either batadv_arp_ip_src or batadv_arp_ip_dst performs an unaligned memory access that triggers a fault on hardware lacking native u...

EUVD-2026-80549

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: avoid unaligned fault in IP extraction Independent of the alignment of the ARP packet in the SKB, either the batadvarpipsrc or the batadvarpipdst will have an unaligned access on HW without native unaligned read...

CVE-2026-89949 batman-adv: dat: avoid unaligned fault in IP extraction

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: avoid unaligned fault in IP extraction Independent of the alignment of the ARP packet in the SKB, either the batadvarpipsrc or the batadvarpipdst will have an unaligned access on HW without native unaligned read...

EUVD-2026-80044

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcpaddstaticipcgi, dhcpstaticipshowcgi, ipaclsetcgi, and ipaclshowcgi. Attackers can inject persistent malicious scripts through these components to...

EUVD-2026-80059

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wanconfigsetcgi, wannumsetcgi, and lanipchangecgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration...

EUVD-2026-80009

On affected platforms running Arista EOS with VRRPv2 IP Authentication Header IP-AH authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the...

SUSE CVE-2026-89478

In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctprcv resolves the transport once per packet and leaves it in chunk-transport. The lookup reference, or the one sctpaddbacklog takes if the socket is owned by userspace, keeps it...

PT-2026-93913

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be...

PT-2026-93694

Name of the Vulnerable Software and Affected Versions WNC T-Mobile 5G Box IDU router versions prior to 1.1.0.651412 Description An authenticated attacker can execute arbitrary commands on the shell and gain root access to the system due to a command injection flaw. The issue occurs in the ping...

PT-2026-93809

Name of the Vulnerable Software and Affected Versions @fastify/proxy-addr versions 3.0.0 through 5.1.0 Description This plugin, used to determine a request's client address behind trusted reverse proxies, incorrectly handles trust subnets written in IPv4-mapped IPv6 notation when an IPv4-sized...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38419)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an improper access control in the getWiFiIpMacTable function. Attackers can exploit this vulnerability by sending specially crafted PO...

CVE-2026-46352: Deadlock

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protoc...