Use of Non-Canonical URL Paths for Authorization Decisions

Overview Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the cleanUsername process. An attacker can gain unauthorized access to another user's files by registering a username that normalizes to the same home directory as an existin...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the cleanUsername process. An attacker can gain unauthorized access to another user's files by registering a username that normalizes to the same home directory as an existin...

GHSA-JR4P-4XJH-FWVW Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail

Summary Koel v9.5.0 contains a Server-Side Request Forgery SSRF vulnerability in the radio station creation endpoint POST /api/radio/stations. The url field validation rules are declared without the bail keyword, so the HasAudioContentType rule — which issues HTTP requests to the supplied URL —...

Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail

Summary Koel v9.5.0 contains a Server-Side Request Forgery SSRF vulnerability in the radio station creation endpoint POST /api/radio/stations. The url field validation rules are declared without the bail keyword, so the HasAudioContentType rule — which issues HTTP requests to the supplied URL —...

GHSA-JHW3-9Q9R-GC5W

creationtimestamp| type| source ---|---|--- 2026-07-15 17:21:51+00:00| seen| https://gist.github.com/Mundi-Xu/99af1b08275fd437cfb79bfe481e68b7...

Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Summary Koel v9.6.0 protects the regular podcast subscription API with SafeUrl, but the Subsonic-compatible createPodcastChannel.view route does not apply the same protection. An authenticated user can supply a private URL and cause Koel to fetch it server-side during podcast parsing. This was...

Server-side Request Forgery (SSRF)

Overview phanan/koel is a personal audio streaming service. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the createPodcastChannel.view process. An attacker can cause the server to initiate HTTP requests to internal or private network resources by...

CVE-2026-60065

creationtimestamp| type| source ---|---|--- 2026-07-15 16:50:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp6j4bs6f2m 2026-07-16 13:00:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqrc4ik4ie2t...

CVE-2026-33213

creationtimestamp| type| source ---|---|--- 2026-07-15 16:37:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp5sefklx2m...

CVE-2026-62175

creationtimestamp| type| source ---|---|--- 2026-07-15 16:35:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp5pcy7rq2s...

CVE-2026-61433

creationtimestamp| type| source ---|---|--- 2026-07-15 16:01:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp3rzyupx2e...

CVE-2026-50148

creationtimestamp| type| source ---|---|--- 2026-07-15 15:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqp3b2jai22u...

CVE-2026-61740

creationtimestamp| type| source ---|---|--- 2026-07-15 15:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqp35kbkrs2j 2026-07-20 22:35:16+00:00| published-proof-of-concept| https://github.com/HKUDS/LightRAG/security/advisories/GHSA-f4vv-55c2-5789...

CVE-2026-62685

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername when Signup=true and CreateUserDir=true, but the many-to-one...

CVE-2026-56339

creationtimestamp| type| source ---|---|--- 2026-07-15 15:41:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp2o7cnt32o 2026-07-16 11:39:38+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mqr5mlyta527...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-HDRI-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q8-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...