CVE-2026-118376

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via webfetch or URL-based knowledge import to reach...

CVE-2026-118376 WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via webfetch or URL-based knowledge import to reach...

CVE-2026-118376 WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via webfetch or URL-based knowledge import to reach...

EUVD-2026-111552

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via webfetch or URL-based knowledge import to reach...

CVE-2026-118376

The WeKnora software (versions prior to 0.8.2 ) contains a server-side request forgery (SSRF) vulnerability in the isRestrictedIP() function. The root cause is the misclassification of NAT64-prefixed IPv6 addresses as public addresses. This allows authenticated attackers to provide URLs that reso...

CVE-2026-118376 WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via webfetch or URL-based knowledge import to reach...

PT-2026-127742

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web fetch or URL-based knowledge import to reach...

SUSE CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

DEBIAN-CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

UBUNTU-CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

EUVD-2026-107997

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

CVE-2026-114730

Roundcube Webmail versions 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 are vulnerable to a Server-Side Request Forgery (SSRF) filter bypass. The underlying cause is that the network blocklist in rcube_utils::is_local_url() failed to include the RFC 6052 NAT64 prefix (64:ff9b::/96), the RFC 8215 l...

CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

Linux Distros Unpatched Vulnerability : CVE-2026-114730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by...