CVE-2026-55787 Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validateurlssrf and isprivateip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition...

GHSA-R7F2-6FJ8-6FG2 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned...

NPM: Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

NPM: Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses vulnerability discovered by ? in WordPress Npm ghost versions = 6.0.9, 6.65.0...

Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned...

Server-side Request Forgery (SSRF)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the IP address validation logic in request-external.js, which fails to correctly classify certain IPv6 transition addresses IPv4-compatible ::/96, IPv4-mapped...

CVE-2026-105689

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT...

CVE-2026-105648 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

CVE-2026-104458 YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...

CVE-2026-85738

TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a...

CVE-2026-85738 TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4)

TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a...

CVE-2026-85738: Server-Side Request Forgery (SSRF)

TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a...

EUVD-2026-82892

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

CVE-2026-93597 ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

CVE-2026-93597 ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

PT-2026-95376

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.9.1 Description Authenticated attackers can bypass the SSRF guard used by the IMPORT DATABASE and server commands. The system fails to validate IPv6 transition addresses, allowing the use of NAT64, 6to4, or Teredo...

CVE-2026-93597: Server-Side Request Forgery (SSRF)

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

CVE-2026-88896: Server-Side Request Forgery (SSRF)

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

EUVD-2026-72871

snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo...

CVE-2026-86735: Server-Side Request Forgery (SSRF)

snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo...

CVE-2026-79749

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, MCPHub's SSRF guard in src/utils/ssrf.ts uses a custom isBlockedIpv6 function that only checks for loopback,...