CVE-2026-33205

Calibre (cross‑platform e‑book manager) has a Server-Side Request Forgery in the ebook viewer’s web view, exposed via the background-image endpoint. Prior to version 9.6.0, an attacker could perform blind GET requests to arbitrary URLs and exfiltrate data from the ebook sandbox. The issue is fixe...

Interpretation Conflict

github.com/traefik/traefik is vulnerable to Interpretation Conflict. The vulnerability is due to improper path normalization when handling Path, PathPrefix, or PathRegex matchers, which allows an attacker to use URL-encoded characters to bypass middleware and access unintended backend services...

CVE-2026-33726 vulnerabilities

Vulnerabilities for packages: hubble-fips, hubble-ui-backend-fips, kubescape-server, kubescape-operator, kubescape-operator-fips, kubescape-server-fips, hubble, hubble-ui, kubescape...

GHSA-HXV8-4J4R-CQGV vulnerabilities

Vulnerabilities for packages: hubble-fips, hubble-ui-backend-fips, kubescape-server, kubescape-operator, kubescape-operator-fips, kubescape-server-fips, hubble, hubble-ui, kubescape...

CVE-2026-24779 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

GHSA-QH4C-XF7M-GXFC vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

CVE-2026-26209 vulnerabilities

Vulnerabilities for packages: py3-cbor2, tritonserver-backend-vllm-cuda-13.0, vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, localstack...

CVE-2026-22778 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

GHSA-3C37-WWVX-H642 vulnerabilities

Vulnerabilities for packages: py3-cbor2, tritonserver-backend-vllm-cuda-13.0, vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, localstack...

CVE-2026-22773 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

GHSA-4R2X-XPJR-7CVV vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

GHSA-GRG2-63FW-F2QR vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

flannel 命令注入漏洞

Flannel is an open-source Kubernetes cluster networking solution developed by flannel-io. Versions of Flannel prior to 0.28.2 contained a command injection vulnerability. This vulnerability originated from the experimental Extension backend. Attackers could exploit this vulnerability by setting u...

CVE-2026-29871

A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 2026-01-19 in the Beifong AI News and Podcast Agent backend in FastAPI backend, stream-audio endpoint, in file routers/podcastrouter.py, in function streamaudio. The stream-aud...

PT-2026-28602

Summary The clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery SSRF. An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. Affected packages Only applicatio...

Medium: gvfs

Issue Overview: A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode PASV response. The client unconditionally trusts this information and attempts to connect to the specified endpoint,...

PT-2026-28388

A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 2026-01-19 in the Beifong AI News and Podcast Agent backend in FastAPI backend, stream-audio endpoint, in file routers/podcast router.py, in function stream audio. The...

CVE-2026-29871

A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 2026-01-19 in the Beifong AI News and Podcast Agent backend in FastAPI backend, stream-audio endpoint, in file routers/podcastrouter.py, in function streamaudio. The stream-aud...

GO-2026-4820 FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel in github.com/gtsteffaniak/filebrowser/backend

FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel in github.com/gtsteffaniak/filebrowser/backend...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the ciltocontainer and bpflxc local-backend packet path in the datapath components. An attacker can bypass ingress network policies and reach a local backend pod by sending traffic through an L7 load...