CVE-2026-84551

CVE-2026-84551 affects Apple's iOS 27 , iPadOS 27 , macOS Golden Gate 27 , visionOS 27 , and watchOS 27 . It stems from a logic issue addressed through improved validation, which may allow an app to bypass network restrictions . The NVD-assigned CVSS 3.1 score is 4.4 (Medium) with a local attack ...

ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification

A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery SSRF due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassificatio...

CVE-2026-28945: Improper Access Control

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to bypass network restrictions...

K000161912: Node.js vulnerability CVE-2026-21711

Security Advisory Description A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket UDS server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under --permission without --allow-net...

CVE-2026-49859: Protection Mechanism Failure

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch was called, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name...

CVE-2026-49860: Server-Side Request Forgery (SSRF)

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially...

PT-2026-50154

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.8.1 Description When opening a WebSocket connection, the runtime validates the destination hostname against --deny-net rules but fails to re-verify the IP addresses the hostname resolves to. This allows an...

CVE-2026-32946: Protection Mechanism Failure

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, the Harden-Runner that allows bypass of the egress-policy: block network restriction using DNS queries over TCP. Egress policies are enforced on GitHub runners by filtering...

CVE-2024-7598 Network restriction bypass via race condition during namespace termination

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies ...

CVE-2024-7598 Network restriction bypass via race condition during namespace termination

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies ...