CVE-2026-88896

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

CVE-2026-88896 EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

CVE-2026-88896 EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

CVE-2026-88896

EspoCRM before 10.0.4 is vulnerable to Server-Side Request Forgery (SSRF) via an IPv6 transition address bypass in HostCheck::ipAddressIsNotInternal(). The function strips ::ffff: (IPv4-mapped IPv6) prefixes but fails to recognize IPv6 transition addresses that embed private IPv4 addresses—NAT64 ...

EUVD-2026-75446

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

Summarypraisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhookURLs by resolving the hostname and checking whether the IP is private. When DNSresolution fails socket.gaierror, the validator silently passes the URL viaexcept socket.gaierror: pass. Additionally, even when DNS...

Malicious code in etoro-cashout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...

MAL-2026-16117 Malicious code in etoro-cashout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...

MAL-2026-16116 Malicious code in etoro-builders (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9210fb131a2f661ae1d656fa461d45c6c54377179aecba06e6a07b4f357a00b The package's preinstall lifecycle script preinstall.js reads the installer's OS hostname, username, and current working directory via os.hostname,...

Malicious code in etoro-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab6228f994962694d4434f53d20d6a5a1b877b39a3498236327da9d0385284d9 The preinstall lifecycle script in [email protected] preinstall.js auto-executes on npm install and performs an HTTP GET to a hardcoded bare-IP...

MAL-2026-16113 Malicious code in etoro-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab6228f994962694d4434f53d20d6a5a1b877b39a3498236327da9d0385284d9 The preinstall lifecycle script in [email protected] preinstall.js auto-executes on npm install and performs an HTTP GET to a hardcoded bare-IP...

Malicious code in etoro-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31819832ff4b43fc9bc7bcd9f3439f71902802331ba6df3c3964c47765397e1 The preinstall lifecycle script in [email protected] unconditionally sends the installer's hostname, OS username, and current working directory to...

Malicious code in etoro-charts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44aff5a1a0b68ff9c9b3456693ef1b8266dce7001dd8b6ff56bed428bbc7c5a On npm install, preinstall.js runs automatically and sends the installer's hostname, username, platform, and current working directory via HTTP GET t...

MAL-2026-16115 Malicious code in etoro-billing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c1ceae274b450706288722b9f6c049114593ef2671de93ac58c4fd4a7318c9a On npm install, the package's preinstall lifecycle hook executes preinstall.js, which reads os.hostname, os.userInfo.username, and process.cwd and...

Exploit for CVE-2026-72815

CVE-2026-72815: go-chi/chi middleware.RealIP IP Spoofing PoC...

PT-2026-89407

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

CVE-2026-45762: Access of Resource Using Incompatible Type

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker used the same IP address family as the packet being...

Outbound Public IP Addresses Used by Veeam Data Cloud

Purpose This article lists the outbound public IP addresses that Veeam Data Cloud uses when connecting from the cloud to infrastructure that a customer hosts and controls, for example a Microsoft Azure Key Vault used for BYOK encryption. These addresses are not used for inbound connections made t...

unimap v0.8.0

Unimap Scan only once by IP address and reduce scan times with Nmap for large amounts of data. Unimap is an abbreviation of "Unique Nmap Scan ". The tool can run in Linux, OSX, Windows or Android Termux without problems. Why? If you have plans to run a Nmap to a whole organization you need to...

CVE-2026-87999

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...