CVE-2026-101087: Server-Side Request Forgery (SSRF)

Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist did not cover IPv6 transition ranges — specifically the 6to4 prefix 2002::/16 and the local-use IPv4/IPv6 translation prefix 64:ff9b:1::/48. Because...

CVE-2024-38063

CVE-2024-38063 - SSP H3 对于这个设置（来自视频的那个），我使用了 Windows 22H2 19045 和 build 2468。（这个 CVE 直到 4780 才被修补） 我在 Qemu/KVM 上尝试过，但网卡没有合并数据包（根据我用 tcpdump 调查的结果）。解决方案是使用 VirtualBox 的 Host-Only 网络。 我尝试了几个 PoC（巧干而非蛮干）： https://github.com/ThemeHackers/CVE-2024-38063...

Blackash-CVE-2025-14558

🚨 CVE-2025-14558 : FreeBSD 中的严重远程代码执行漏洞 IPv6 🧠 概述 CVE-2025-14558 是一个严重远程代码执行 RCE 漏洞 ，影响使用 IPv6 路由器请求服务的 FreeBSD 系统。在处理不受信任的网络输入时存在缺陷，允许攻击者执行任意 shell 命令。 📊 严重性 CVSS v3 评分： 9.8 / 10 🔥 风险等级： 严重 所需权限： 无 用户交互： 无 🎯 受影响组件 rtsol8 rtsold8 使用 IPv6 无状态地址自动配置 SLAAC 的 FreeBSD 系统 ⚙️ 技术细节 恶意的 IPv6 路由器通告 RA...

CVE-2024-38063-Medium

这是针对 CVE-2024-38063 的 PoC（不太稳定），是 tcpip.sys 中的 RCE，已于 2024 年 8 月 13 日修补。 要求 pip3 install scapy 用法 修改脚本中的字段： iface - 如果您有多个适配器，则必须选择用于发送数据包的适配器。例如，Linux 上的 "eth0" 或 Windows 上的 "Hyper-V Virtual Ethernet Adapter"。如果您将使用默认接口，请留空。 ipaddr - 目标系统的 IP 地址（IPv6） numtries & numbatches -...

Citrix-NetScaler-Memory-Leak-CVE-2025-5777

CVE-2025-5777 – Fuga de Memoria en Citrix NetScaler PoC Actualizado Este repositorio contiene un Proof-of-Concept PoC actualizado para explotar CVE-2025-5777 – una vulnerabilidad de fuga de memoria que afecta a Citrix NetScaler. El PoC original de 0xgh057r3c0n funciona perfectamente, pero algunos...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ipv6: Proper accounting of fraggap on the paged allocation path In ip6.AppendData, when the paged-allocation branch is taken MSGMORE / NETIFFSG / large fraglen, alloclen and pagedlen are computed as follows: alloclen =...

CVE-2024-38063

CVE-2024-38063 PoC | DKob & N3TCR4SH Resumen Este script es una Prueba de Concepto PoC para explotar CVE-2024-38063. Genera y envía paquetes IPv6 fragmentados maliciosos con opciones de destino específicas para atacar un kernel, lo que podría causar una denegación de servicio o inestabilidad...

AZL-104895 CVE-2026-91768 affecting package php 8.3.33-1

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

DEBIAN-CVE-2026-91768

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2026-91768

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2026-91768

A flaw was found in PHP. The access control check for Internet Protocol version 6 IPv6 addresses in the FastCGI implementation compares only the first 12 bytes of a 16-byte address instead of the complete address. An attacker on an adjacent network with an address sharing the first 96 bits with a...

CVE-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2026-91768

The PHP FastCGI client contains an IPv6 access control bypass vulnerability (CVE-2026-91768 ). The issue stems from the IPv6 branch of the FastCGI client access check, which incorrectly compares only the first 12 bytes of a 16-byte IPv6 address. This causes listen.allowed_clients to match on a /9...

EUVD-2026-87350

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2026-91768

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2026-91768

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2026-100390

Zoraxy versions 3.2.3 through 3.3.4 are vulnerable to client IP spoofing due to a failure to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. This allows unauthenticated attackers connecting over IPv6 to supply arbitrary X-Forwarded-For values. Consequently, a...

EUVD-2026-87327

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access...

CVE-2026-100390 Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access...