CVE-2026-59707 LocalAI - Server-Side Request Forgery via POST /models/apply

LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper...

CVE-2026-48947

creationtimestamp| type| source ---|---|--- 2026-07-07 20:37:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3hi2txei2i 2026-07-08 14:15:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq5claiknt2n...

CVE-2026-23697

creationtimestamp| type| source ---|---|--- 2026-07-07 19:58:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3fcys7xx2w 2026-07-10 17:49:13+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mqcphwfowu2j 2026-07-13 22:00:10+00:00| seen|...

CVE-2026-23698

creationtimestamp| type| source ---|---|--- 2026-07-07 19:53:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3f22eb4o2u 2026-07-13 22:00:10+00:00| seen| https://t.me/GithubRedTeam/92380 2026-07-14 00:00:18+00:00| seen| https://t.me/GithubRedTeam/92380 2026-07-15 00:00:31+00:00|...

CVE-2026-59800

creationtimestamp| type| source ---|---|--- 2026-07-07 19:33:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3dwalhqt22 2026-07-07 20:35:03+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-g6g7-pvmx-m74p 2026-07-07 20:52:05+00:00| seen|...

CVE-2026-13020

creationtimestamp| type| source ---|---|--- 2026-07-07 19:25:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3dhu46ku2f 2026-07-09 15:02:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq7vo4wlz32b 2026-07-21 23:07:06+00:00| seen|...

CVE-2026-13019

creationtimestamp| type| source ---|---|--- 2026-07-07 17:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq35do63e62b 2026-07-07 19:48:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3er3vied2z 2026-07-08 12:14:06+00:00| seen|...

CVE-2011-10043

creationtimestamp| type| source ---|---|--- 2026-07-07 17:34:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq35a4wvad2x 2026-07-07 19:38:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3e7727ll2z 2026-07-08 11:00:04+00:00| seen|...

CVE-2021-20102

creationtimestamp| type| source ---|---|--- 2026-07-07 16:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq2yeliqdm24...

PYSEC-2026-1100 AIOHTTP vulnerable to denial of service through large payloads

Summary A request can be crafted in such a way that an aiohttp server's memory fills up uncontrollably during processing. Impact If an application includes a handler that uses the Request.post method, an attacker may be able to freeze the server by exhausting the memory. ----- Patch:...

PYSEC-2026-1107 AIOHTTP vulnerable to DoS when bypassing asserts

Summary When assert statements are bypassed, an infinite loop can occur, resulting in a DoS attack when processing a POST body. Impact If optimisations are enabled -O or PYTHONOPTIMIZE=1, and the application includes a handler that uses the Request.post method, then an attacker may be able to...

PYSEC-2026-1360 FastAPI Guard has a regex bypass

Summary The regular expression patched to mitigate the ReDoS vulnerability by limiting the length of string fails to catch inputs that exceed this limit. Details In version 3.0.1, you can find a commit like the one in the link below, which was made to prevent ReDoS...

CVE-2026-44938

creationtimestamp| type| source ---|---|--- 2026-07-07 15:37:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2wp7phd52e...

CVE-2026-48588

creationtimestamp| type| source ---|---|--- 2026-07-07 15:02:03+00:00| seen| https://bsky.app/profile/selfhost.directory/post/3mq2uqb2zhm2c 2026-07-07 15:04:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2uvi6mb22w 2026-07-07 16:28:41+00:00| seen|...

PYSEC-2026-1541 LiteLLM Vulnerable to Remote Code Execution (RCE)

BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'postcallrules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function...

PYSEC-2026-1982 Transformers Regular Expression Denial of Service (ReDoS) vulnerability

A Regular Expression Denial of Service ReDoS vulnerability was identified in the huggingface/transformers library, specifically in the file tokenizationnougatfast.py. The vulnerability occurs in the postprocesssingle function, where a regular expression processes specially crafted input. The issu...

PYSEC-2026-1779 PheonixAppAPI has visible Encoding Maps

Impact This is a kind of moderate issue. The impact is not big for normal users but can be for users who want to secure their code/files/etc. The issue is that the map of encoding/decoding languages are visible in code. Patches The Problem was patched in 0.2.5, so you should try to upgrade to the...

CVE-2025-64636

creationtimestamp| type| source ---|---|--- 2026-07-07 14:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq2s64b4pj24...

CVE-2026-40187

creationtimestamp| type| source ---|---|--- 2026-07-07 14:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq2s2h3gp32g 2026-07-07 14:35:10+00:00| published-proof-of-concept| https://github.com/EGroupware/egroupware/security/advisories/GHSA-8737-2x9g-xjj7...

GHSA-26V7-H57M-GH9M New API is vulnerable to CSRF through user email binding

Summary The email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth...