vulnerability-lookup CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM vulnerability-lookup CVE published 2026-08-10

CVE-2026-72761

The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution. However, IPv6 transition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo `2001:0000::/32`) are classified as globally routable by IANA, allowing an attacker to register a webhook pointing at a hostname that resolves to a transition address to bypass the SSRF g [truncated]