5606 matches found
CVE-2026-85242
PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...
CVE-2026-85242
PlaywrightCapture is vulnerable to a server-side request forgery (SSRF) in its favicon retrieval functionality. When only_global_lookup is enabled, the application validates the initial favicon URL against localhost, loopback, and other non-public addresses, but redirects followed by aiohttp were...
CVE-2026-85242 Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture
PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...
CVE-2026-85242 Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture
PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...
CVE-2026-85242 Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture
PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...
CLSA-2026-1788442611 TuxCare security update for aiohttp (1 CVE)
TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.1.post12+tuxcare...
PT-2026-85085
PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When only global lookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...
CVE-2026-85242: Server-Side Request Forgery (SSRF)
PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...
PT-2026-90925
TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.1.post12+tuxcare...
RHEL 9 : Satellite 6.17.11 Async Update (Important) (RHSA-2026:63387)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63387 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...
CLSA-2026-1788349677 TuxCare security update for aiohttp (1 CVE)
TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.6.post12+tuxcare...
CLSA-2026-1788347890 TuxCare security update for aiohttp (1 CVE)
TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.5.post11+tuxcare...
SUSE CVE-2026-37237
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read without enforcing a maximum response...
PT-2026-90679
TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.5.post11+tuxcare...
PT-2026-90692
TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.6.post12+tuxcare...
openSUSE 16 Security Update : python-aiohttp (openSUSE-SU-2026:21687-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21687-1 advisory. - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate...
SUSE-SU-2026:23571-1 Security update for python-aiohttp
This update for python-aiohttp fixes the following issues: - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. - CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...
OPENSUSE-SU-2026:21687-1 Security update for python-aiohttp
This update for python-aiohttp fixes the following issues: - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. - CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...
OESA-2026-3583 python-aiohttp security update
Async http client/server framework asyncio. Security Fixes: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attack...
OESA-2026-3582 python-aiohttp security update
Async http client/server framework asyncio. Security Fixes: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attack...