CVE-2026-54493 Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API...

CVE-2026-54493

Koel (open-source music streaming, PHP/Laravel) versions prior to 9.7.0 are vulnerable to an authenticated full-read SSRF via its Subsonic-compatible radio endpoints. The createInternetRadioStation.view and updateInternetRadioStation.view routes accept a user-supplied streamUrl without the SafeUr...

CVE-2026-54494 Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4

Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost uses filtervar with FILTERFLAGNOPRIVRANGE and FILTERFLAGNORESRANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An...

CVE-2026-54492 Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular...

CVE-2026-75616 Command Injection in Router Web Management Interface

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting...

EUVD-2026-63081

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting...

CVE-2026-75616

An OS command injection vulnerability exists in the web management interface of the TP-Link Archer C20 v6 firmware . Insufficient input validation in certain WAN-related configuration operations allows an authenticated administrator to execute arbitrary system commands with elevated privileges, p...

CVE-2026-68555

Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobilebegintransition in src/server/nsturnserver.c disarms each...

EUVD-2026-63080

Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobilebegintransition in src/server/nsturnserver.c disarms each...

CVE-2026-68555 coturn: Chained mobility resumes allow authenticated remote memory exhaustion

Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobilebegintransition in src/server/nsturnserver.c disarms each...

CVE-2026-68555 coturn: Chained mobility resumes allow authenticated remote memory exhaustion

Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobilebegintransition in src/server/nsturnserver.c disarms each...

CVE-2026-68555

Coturn 4.15.0 (open-source TURN/STUN server) is vulnerable to authenticated remote memory exhaustion when the --mobility flag is enabled. An authenticated TURN user can repeatedly resume a single allocation from fresh UDP 5-tuples without completing a handoff. The root cause is in mobile_begin_tr...

CVE-2026-68553 Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...

CVE-2026-68553 Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...

EUVD-2026-63077

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...

CVE-2026-53547 Termix: Account Takeover via Global Settings Disclosure

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...

CVE-2026-53549

An authenticated low-privileged user can exploit the unvalidated POST /host/db/proxy/test endpoint to probe internal hosts, metadata services, and cloud credentials; fixed in Termix 2.3.2. No exploitation evidence provided in the documents.

EUVD-2026-62854

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service and obtain sensitive information due to an out-of-bounds read...

CVE-2026-17015 IBM i Denial of Service

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service and obtain sensitive information due to an out-of-bounds read...

CVE-2026-17015

IBM i versions 7.3 through 7.6 are affected by an out-of-bounds read (CWE-125) in the 5770-SS1 feature, allowing a remote authenticated attacker to cause a denial of service and obtain sensitive information. IBM rates the vulnerability CVSS 5.4 (MEDIUM) while the NVD assigns 8.1 (HIGH) , reflecti...