CVE-2026-35219 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification

A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery SSRF due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassificatio...

Important: Red Hat Security Advisory: nodejs:24 security update

An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

MINI-F59Q-FQFR-67FC

Bulletin has no description...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

Important: Red Hat Security Advisory: nodejs22 security update

An update for nodejs22 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Improper Access Control

org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an improper access control. The vulnerability is due to an inverted IP address validation check that rejects legitimate requests from the bound IP address while allowing requests from other IP addresses, which allows an attacker to bypass...

CVE-2026-12630: Out-of-bounds Read

Zephyr's 6LoWPAN IP Header Compression IPHC uncompression code contains an out-of-bounds read in getihpcinlinedsize subsys/net/ip/6lo.c. The destination inline size is looked up in dainlinesizetable, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC...

ALSA-2026:55541 Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed...

PT-2026-73201

A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument dest port/dest ip leads to os command injection. The attack may be initiated remotely. Upgrading to...

nodejs22 security update

1:22.23.1-4.0.1 - Add c-ares as dependency orabug 39781219 1:22.23.1-6 - Fix for CVE-2026-69152 1:22.23.1-5 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address 1:22.23.1-4 - Fix CVE-2026-13149 npm/brace-expansion 1:22.23.1-3 - Fix for CVE-2026-59873 and Fix for CVE-2026-59874 node-tar...

RHEL 10 : nodejs22 (RHSA-2026:55541)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55541 advisory. Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an...

About the security content of visionOS 26.6.1

About the security content of visionOS 26.6.1 This document describes the security content of visionOS 26.6.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100760)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100760 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv4: restrict IPOPTSSRR and IPOPTLSRR options This patch restricts setting Loose Source and Reco...

phpSysInfo 3.4.5 - IP Allowlist Bypass

Exploit Title: phpSysInfo 3.4.5 - IP Allowlist Bypass Google Dork: N/A Date: 2026-07-11 Exploit Author: Muhammed Mirac Kayikci Vendor Homepage: https://phpsysinfo.github.io/phpsysinfo/ Software Link: https://github.com/phpsysinfo/phpsysinfo/archive/refs/tags/v3.4.5.tar.gz Version: "Client IP...

ALSA-2026:55603 Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash...

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-099242)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099242 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctpprocessasconf caches the...