CVE-2026-118376

MediumCVSS 5.3/10Last modified Oct 28, 2026

Description

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach internal services or cloud metadata endpoints.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Tencent	WeKnora	>= 0.2.11, < 0.8.2

References

Timeline

Published: Oct 28, 2026
Last modified: Oct 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1183777.5mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to for CVE-2026-1183787.8Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements b CVE-2026-118384.3Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Ind CVE-2026-1183839.0A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The c CVE-2026-1183846.1GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.CVE-2026-1183866.5Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were d CVE-2026-118399.9Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies Inc. Rotaban allows Upload a Web Shell t CVE-2026-1183918.9Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust CVE-2026-1183944.3The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the CVE-2026-1183957.5Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/CVE-2026-11847.5GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 t CVE-2026-118408.8Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticate