CVE-2026-73297

The CVE-2026-73297 entry concerns Microsoft UFO, an open-source framework for automation across devices and platforms. Before version 3.0.8, the function _is_blocked_ip in ufo/utils/url_security.py failed to block IPv6 NAT64 prefixes (64:ff9b::/96 and 64:ff9b:1::/48), the 6to4 prefix (2002::/16),...

EUVD-2026-57325

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, isblockedip in ufo/utils/urlsecurity.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check embedde...

ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification

A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery SSRF due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassificatio...

PT-2026-71153

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, is blocked ip in ufo/utils/url security.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check...

Linux Distros Unpatched Vulnerability : CVE-2026-73212

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, goodpeeraddr in src/server/nsturnserver.c uses ioaaddrinrange in...

UBUNTU-CVE-2026-73212

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, goodpeeraddr in src/server/nsturnserver.c uses ioaaddrinrange in src/client/nsturnioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 T...

CVE-2026-73212 coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, goodpeeraddr in src/server/nsturnserver.c uses ioaaddrinrange in src/client/nsturnioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 T...

EUVD-2026-56789

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, goodpeeraddr in src/server/nsturnserver.c uses ioaaddrinrange in src/client/nsturnioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 T...

CVE-2026-72784

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

CVE-2026-72784 Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

CVE-2026-72784 Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

CVE-2026-72784

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

CVE-2026-72784

CVE-2026-72784 affects Craft CMS versions 5.0.0-RC1 through 5.10.5 and 4.0.0-RC1 through 4.18.1. The vulnerability is a server-side request forgery (SSRF) in the GraphQL saveAsset mutation that fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp() does...

EUVD-2026-56108

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

CVE-2026-72784 Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

PT-2026-70202

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

PT-2026-70799

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.13.1 Description The good peer addr function in src/server/ns turn server.c utilizes ioa addr in range in src/client/ns turn ioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms...

CVE-2026-72761

The webhook URL validator in website/notifications/webhooks.py uses ip.isglobal to reject non-public addresses after DNS resolution. IPv6 transition addresses NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32 are classified as globally routable by IANA, so isglobal returns True even when...

CVE-2026-72761 Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is_global check) in vulnerability-lookup

The webhook URL validator in website/notifications/webhooks.py uses ip.isglobal to reject non-public addresses after DNS resolution. IPv6 transition addresses NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32 are classified as globally routable by IANA, so isglobal returns True even when...

CVE-2026-70485 Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.isglobal to the literal IPv6 address without examining IPv4 addresses embedded in...