Apprise forwards configured auth headers across cross-origin HTTP redirects

Summary Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders apprise/attachment/http.py, apprise/config/http.py follow HTTP 3xx redirects by default and re-send the user-configured auth headers and query parameters on the redirected request. If an operator-configured...

CVE-2026-62308 Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...

CVE-2026-62308 Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...

EUVD-2026-90194

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...

CVE-2026-62308 Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...

CVE-2026-62308

Prior to version 1.30.6 , Tugtainer (a self-hosted app for automating Docker container updates) is vulnerable to an authenticated blind server-side request forgery (SSRF) . The /settings/test_notification endpoint accepts a urls field and passes it directly to Apprise without restricting protocol...

CVE-2026-62308: Server-Side Request Forgery (SSRF)

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...

OPENSUSE-SU-2026:21789-1 Security update for python-apprise

This update for python-apprise fixes the following issues: Changes in python-apprise: - CVE-2026-59180: Information disclosure via HTTP redirect following with credential resending bsc1271342...

SUSE CVE-2026-59180

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py...

CVE-2026-59180

A flaw was found in Apprise, an open-source library for sending notifications. HTTP-based notification plugins and HTTP attachment and configuration loaders in Apprise, prior to version 1.11.0, automatically follow HTTP redirects. During these redirects, user-configured authentication headers and...

DEBIAN-CVE-2026-59180

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py...

CVE-2026-59180

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py...

UBUNTU-CVE-2026-59180

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py...

Insertion of Sensitive Information Into Sent Data

Overview apprise is an Apprise - Push Notifications that work with just about every platform!. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the HTTP-based notification plugins and HTTP attachment/config loaders when authentication header...

better-social-notifications (>=1.0.0, <=20260529145048.0.0.dev0), changedetection-io (>=0.39.18, <=0.60.3) +20 more potentially affected by CVE-2026-59180 via apprise (>=1.0.0, <=1.10.0)

apprise PYPI version =1.0.0, =1.0.0, =0.39.18, =1.0.0, =0.1.0, =0.95.0, =1.3.0, =0.8.0, =0.3.0rc1, =0.0.6, =0.0.25 - proxy-rotator-toolkit 0.0.26 and more Source cves: CVE-2026-59180 Source advisory: SNYK:PYTHON-APPRISE-17950949...

apprise-transactions (1.0.0), better-social-notifications (>=1.0.0, <=20260529145048.0.0.dev0) +21 more potentially affected by CVE-2026-59180 via apprise (>=0.8.5, <=1.10.0)

apprise PYPI version =0.8.5, =1.0.0, =0.38.2, =1.0.0, =0.1.0, =0.95.0, =1.3.0, =0.8.0, =0.3.0rc1, =0.0.6, =0.0.25 and more Source cves: CVE-2026-59180 Source advisory: MEND:CVE-2026-59180...

CVE-2026-59180 Apprise forwards configured auth headers across cross-origin HTTP redirects

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py...

CVE-2026-59180

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py...

CVE-2026-59180 Apprise forwards configured auth headers across cross-origin HTTP redirects

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py...

CVE-2026-59180 Apprise forwards configured auth headers across cross-origin HTTP redirects

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py...