Apache TomEE's embedded Derby network service ignores its configured bind address and listens on all network interfaces. This allows remote attackers with network access to connect to the database server and read or modify data. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
Apache TomEE's development-time LiveReload feature listens on all network interfaces without authentication and accepts websocket connections from any origin. This allows a network attacker or a web page visited by the developer to observe file changes and server version, and potentially access deployed applications through the additional port. The issue affects LiveReload enabled in the embedded Maven plugin. Upgrading to versions 10.3.0 or 11.0.0-M2 resolves the vulnerability.
A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.
CVE-2026-119249 is a vulnerability in Ubiquiti Inc's WiFiman Desktop application where the software binds to an unrestricted IP address. This flaw could allow a malicious actor on the same network to obtain information about the host device. The vulnerability affects versions prior to 1.3.0 and has been assigned a high severity score of 7.5. A fix is available starting from version 1.3.0.
CVE-2026-59177 is a vulnerability in ESPHome Device Builder Dashboard versions prior to 1.0.10 where the Home Assistant add-on's trusted ingress site binds to all network interfaces (0.0.0.0) without authentication. This allows any device on the local network to access the dashboard directly, bypassing supervisor authentication. The dashboard provides powerful capabilities including compile-time Python execution, shell execution, and access to configuration and data files, leading to full compromise of the Home Assistant configuration and managed ESPHome devices. The issue is fixed in version 1.0.10.
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 contain a vulnerability where the software binds to an unrestricted IP address. This flaw could allow a remote attacker to obtain sensitive information. The vulnerability is identified as CWE-1327 and has a critical CVSS score of 9.8.
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding, with impact determined by the registered file, shell, and code-execution tools. This vulnerability is fixed in praisonaiagents 1.6.59.
IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote attacker to obtain sensitive information due to a security misconfiguration where the documentation server binds to an unrestricted IP address.
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration.
The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to loopback.
Affected Spring Products and Versions:
Spring Tools for Eclipse: 5.2.0 and earlier
9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy request is local by reading the client-controlled Host header, allowing a remote unauthenticated attacker to send Host: localhost and bypass API-key authentication. In the default configuration, this exposes the /v1 proxy to upstream provider calls using stored provider credentials and allows /v1/search with the searxng provider_options.baseUrl parameter to drive server-side requests to internal or cloud-metadata hosts. This issue is fixed in version 0.5.2.
Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in loss of availability
The golang.org/x/tools/gopls language server has a vulnerability where it may bind to the unrestricted IP address 0.0.0.0 when started with certain debugging flags (-listen without explicit host or -port). This behavior can expose the service to network attackers on the same network, potentially allowing arbitrary code execution. The vulnerability is rated high severity with a CVSS score of 8.8. No official patch or remediation guidance is currently provided by the vendor. Users should be cautious when using these flags and avoid binding gopls to all network interfaces unless necessary.
A vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.
Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.
A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read, write, or delete arbitrary files and folders on the target machine
Vulnerabilities* in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems.
* vulnerabilities:
*
Improper Neutralization of Special Elements used in a Command ('Command Injection')
* Use of Hard-coded Credentials
* Improper Authentication
* Binding to an Unrestricted IP Address
The vulnerability has been rated as critical.This issue affects ActADUR: from v2.0.1.9 before v2.0.2.0., hence updating to version v2.0.2.0.or above is required.
CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.