CWE-697 Incorrect Comparison

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses

Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation

Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement

Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

js-toml has silent type confusion via falsy-primitive duplicate-key bypass

hermes-agent has an Incorrect Comparison

gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host

PickleScan's profile.run blocklist mismatch allows exec() bypass

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers

fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)

Parse Server has a session field immutability bypass via falsy-value guard

mppx has Stripe charge credential replay via missing idempotency check

Bug fixes in hpke-rs, hpke-rs-rust-crypto

rs-soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction

MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling

Improper Digest Verification in httpsig-hyper May Allow Message Integrity Bypass

TCPDF has incorrect comparison

Dragonfly vulnerable to timing attacks against Proxy’s basic authentication

`idna` accepts Punycode labels that do not produce any non-ASCII when decoded

Apache NiFi Insufficient Property Validation vulnerability