CVE-2026-123201

Buku (bukuserver) versions through 5.1.1 are vulnerable to an unauthenticated server-side request forgery (SSRF) . The flaw exists in the /api/fetch_data and /api/network_handle endpoints, where the application fails to properly validate the url parameter. Attackers can bypass the weak is_bad_url...

EUVD-2026-117646

Buku bukuserver through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetchdata or /api/networkhandle. Attackers can target loopback, private, or cloud metadat...