CVE-2026-56179 Windows Network Address Translation (NAT) Spoofing Vulnerability

...

CVE-2026-56179: Origin Validation Error

Origin validation error in Windows Network Address Translation NAT allows an unauthorized attacker to perform spoofing over an adjacent network...

CVE-2026-72761

The CVE affects the webhook URL validator in website/notifications/webhooks.py, which uses ip.is_global after DNS resolution. IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32) are categorized as globally routable by IANA, causing is_global to return True even w...

PYSEC-2026-3645 Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and do...

penetration-testing-windows10

Vulnerability Analysis and Penetration Testing Using Metasploi...

SUSE CVE-2026-53520

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing. This issue has been patched in version 2.1.0...

CVE-2026-54272

The CVE affects the ip-address JavaScript library (versions 10.1.1–10.2.0). A misclassification of IPv4-mapped/NAT64 IPv6 addresses in Address6.getType() caused SSRF and trust-boundary issues by not normalizing mapped addresses to IPv4 before checks, due to the IPv6 special-use prefix table missi...

CVE-2026-63913

The CVE-2026-63913 entry concerns the Linux kernel netfilter conntrack TCP state machine. A crafted RST with an invalid SEQ after observing a SYN could transition the conntrack entry to TCP_CONNTRACK_CLOSE, even if the RST is not a valid response to the observed SYN or its direction. This could p...

CVE-2026-63913

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an...

PT-2026-61230

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state via an RST packet with an invalid sequence number. After a SYN packet is...

CVE-2026-56181 Windows Network Address Translation (NAT) Spoofing Vulnerability

...

CVE-2026-56181

CVE-2026-56181 is a Windows Network Address Translation (NAT) spoofing vulnerability caused by an origin-validation error. It enables an adjacent-network attacker to impersonate a user on the NATed network, with high impact (code/privilege implications per report). Microsoft has released updates;...

CVE-2026-56181 Windows Network Address Translation (NAT) Spoofing Vulnerability

...

EUVD-2026-44294

Use after free in Microsoft NAT Helper Components ipnathlp.dll allows an authorized attacker to elevate privileges locally...

Windows Network Address Translation (NAT) Spoofing Vulnerability

Origin validation error in Windows Network Address Translation NAT allows an unauthorized attacker to perform spoofing over an adjacent network...

PT-2026-58599

Name of the Vulnerable Software and Affected Versions Windows Network Address Translation NAT affected versions not specified Description An origin validation error in Windows Network Address Translation NAT allows an unauthorized attacker to perform spoofing over an adjacent network, enabling th...

CVE-2026-56181: Origin Validation Error

Origin validation error in Windows Network Address Translation NAT allows an unauthorized attacker to perform spoofing over an adjacent network...

pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

Summaryisglobaladdress in src/pyload/core/utils/web/check.py is the central guard against SSRF-style outbound connections in pyload-ng. It tests whether a given IP is "globally routable" via Python's ipaddress.ipaddressvalue.isglobal, and callers treat not isglobal as "deny":pythondef...

GO-2026-5824 Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing in github.com/nezhahq/nezha

Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf

Summary flyto-core's SSRF protection validateurlssrf / isprivateip in src/core/utils.py blocks private and metadata destinations by resolving the host and testing the resulting IP for membership in a hardcoded PRIVATEIPRANGES list. That list contains only the native RFC 1918 / loopback / link-loc...