edge

Cloud edge - Whois для облака Проверьте IP, чтобы определить облачного провайдера и другие детали на основе опубликованных провайдером данных в форматах JSON, CSV или текстовых файлов Cloud edge — это инструмент разведки, ориентированный на исследование облачных провайдеров. Он может использовать...

EUVD-2026-81594

vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted...

DEBIAN-CVE-2026-91768

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

AZL-104895 CVE-2026-91768 affecting package php 8.3.33-1

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2026-91768

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2026-91768

The PHP FastCGI client contains an IPv6 access control bypass vulnerability (CVE-2026-91768 ). The issue stems from the IPv6 branch of the FastCGI client access check, which incorrectly compares only the first 12 bytes of a 16-byte IPv6 address. This causes listen.allowed_clients to match on a /9...

CVE-2026-91768

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

Directory Traversal

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Directory Traversal via the isPathAllowedForModule function. An attacker can access non-allowlisted modules by exploiting prefix matching in module...

Duplicate Advisory: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7q3f-wx44-378m. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string...

CVE-2026-92945

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

CVE-2026-92945 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

CVE-2026-92945 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

CVE-2026-92945 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

CVE-2026-92945

vm2 before 3.11.7 contains a module allowlist bypass in the isPathAllowedForModule function. The root cause is the use of raw string prefix matching instead of a boundary-anchored comparison, allowing attackers to reach non-allowlisted packages that share a name prefix with an allowlisted module....

CVE-2026-92776

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access...

CVE-2026-92812

decap-server , the local server component of the decap-cms content management system, is affected by a path traversal vulnerability in its local proxy containment guard. The guard performs a plain string prefix comparison without validating path separators, allowing attackers to access sibling di...

CVE-2026-92812 decap-server Path Traversal via Sibling Directory Prefix Matching

decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outsi...

CVE-2026-92776 Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access...

CVE-2026-92776 Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access...

CVE-2026-92776 Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access...