CVE-2026-123201

A flaw was found in buku. This vulnerability allows an unauthenticated remote attacker to cause information disclosure through Server-Side Request Forgery SSRF due to improper URL validation in the bukuserver component. By supplying crafted web addresses to API endpoints, an attacker can coerce t...

CVE-2026-123201

Buku (bukuserver) versions through 5.1.1 are vulnerable to an unauthenticated server-side request forgery (SSRF) . The flaw exists in the /api/fetch_data and /api/network_handle endpoints, where the application fails to properly validate the url parameter. Attackers can bypass the weak is_bad_url...

EUVD-2026-117646

Buku bukuserver through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetchdata or /api/networkhandle. Attackers can target loopback, private, or cloud metadat...

CVE-2026-121627

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView.listentry. Attackers can submit a URL containing a double quote and event handler through the...

EUVD-2026-116102

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView.listentry. Attackers can submit a URL containing a double quote and event handler through the...

CVE-2026-121627 buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView.listentry. Attackers can submit a URL containing a double quote and event handler through the...

CVE-2026-121627

Versions 5.0 through 5.1.1 of buku contain a stored cross-site scripting (XSS) vulnerability within the bukuserver bookmark list. The root cause is an unescaped bookmark URL in the BookmarkModelView._list_entry() function. An unauthenticated attacker can submit a URL containing a double quote and...

PT-2026-102995

A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file application/modules/web/controllers/buku tamu.php of the component Guest Book. This manipulation of the argument nama/email/pesan causes...

[SECURITY] Fedora 40 Update: buku-4.9-1.fc40

Buku is a powerful bookmark manager written in Python3 and SQLite3. Buku fetches the title of a bookmarked web page and stores it along with any additional comments and tags. You can use your favourite editor to compose and update bookmarks. With multiple search options, including regex and a dee...

[SECURITY] Fedora 41 Update: buku-4.9-1.fc41

Buku is a powerful bookmark manager written in Python3 and SQLite3. Buku fetches the title of a bookmarked web page and stores it along with any additional comments and tags. You can use your favourite editor to compose and update bookmarks. With multiple search options, including regex and a dee...

Fedora: Security Advisory (FEDORA-2025-df3432c3ee)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 40 : buku (2025-df3432c3ee)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-df3432c3ee advisory. Update to 4.9 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issu...

Fedora 41 : buku (2025-e035838041)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e035838041 advisory. Update to 4.9 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issu...