EUVD-2026-39025

Ghost: Private IP filtering bypass to make server-side requests to internal services...

EUVD-2026-52898

A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The...

CVE-2026-18812 H3C NX15 esps esps.ipv6.wan command injection

A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The...

CVE-2026-18812

The CVE-2026-18812 entry concerns H3C NX15 V100R017. The affected component is esps.ipv6.wan in the /api/esps path. The root cause is manipulation of the argument workMode, enabling command injection. Exploitation is possible remotely, with a published exploit. The CVE documents do not provide re...

CVE-2026-70485

CVE-2026-70485 – Open WebUI : Affected versions 0.9.0 through 0.11.0 of the Open WebUI self-hosted AI platform check whether a user-provided URL is globally routable by applying ipaddress.is_global to the literal IPv6 address, without considering embedded IPv4 in transition encodings. In NAT64 de...

netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation

A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended...

EUVD-2026-52687

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...

CVE-2026-70367

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...

MiracleLinux 9 : runc-1.4.2-2.el9_8 (AXSA:2026-1427:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1427:03 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2026-500121)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500121 advisory. - xfs: resample the data fork mapping after cycling ILOCK Darrick J. Wong Orabug: 39776792 CVE-2026-64600 - net/sched: fix pedit partial COW...

CVE-2026-69198 ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

Summary Address6's special-property checks misclassify IPv4-mapped ::ffff:0:0/96 and NAT64 well-known 64:ff9b::/96 IPv6 addresses. These checks classify an address by its IPv6 wrapper rather than by the IPv4 address it embeds, so isLoopback, isLinkLocal, isMulticast, and isUnspecified all return...

EUVD-2026-49375

ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks...

Security Bulletin: There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-44249)

Summary There is a vulnerability in netty-handler-4.1.133.Final.ja used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-44249 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. In...

Oracle Linux 10 : kernel (ELSA-2026-47017)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47017 advisory. - ipv6: fix possible UAF in icmpv6rcv CKI Backport Bot RHEL-192215 CVE-2026-53006 - tipc: fix double-free in tipcbufappend CKI Backport Bot RHEL-1921...

CVE-2026-10686

Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6routepacket subsys/net/ip were affected: the explicit-route path netroutepacket and the on-link cross-interface path netroutepacketif. Each set the packet...

CVE-2026-10686 Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers

Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6routepacket subsys/net/ip were affected: the explicit-route path netroutepacket and the on-link cross-interface path netroutepacketif. Each set the packet...

CVE-2026-10686 Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers

Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6routepacket subsys/net/ip were affected: the explicit-route path netroutepacket and the on-link cross-interface path netroutepacketif. Each set the packet...

Oracle Linux 9 : kernel (ELSA-2026-45192)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-45192 advisory. - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Aidan Wallace RHEL-213468 CVE-2026-63807 - KVM: x86: Don't recheck L1...

MiracleLinux 9 : buildah-1.43.1-2.el9_8 (AXSA:2026-1405:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1405:05 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient...