CVE-2010-5301

CVE-2010-5301 A proof of concept of an SEH overflow with arbitrary dll injection Description Kolibrì HTTP Server 2.0 is affected by a stack-based buffer overflow. At the time of discovery this vulnerability was exploited by simply overwriting the instruction pointer with a JMP ESP instruction,...

CVE-2026-48053

Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...

CVE-2026-48053

Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated "baseurl" parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoint...

CVE-2026-48053

Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...

CVE-2026-48053 Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset

Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...

CVE-2026-48053 Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset

Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...

CVE-2026-48053 Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset

Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...

CVE-2026-48053

Kolibri versions before 0.19.4 have an unauthenticated SSRF in RemoteFacilityUserViewset (api.py:1570) and three other endpoints: the baseurl parameter is only scheme-validated, and requests follows 30x redirects, allowing attackers to pivot fetches to internal services or cloud metadata (AWS IMD...

EUVD-2026-60319

Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...

CVE-2026-48053: Server-Side Request Forgery (SSRF)

Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...

ads-and (>=0.1.0, <=0.1.3), ads-bib (>=0.1.0, <=0.3.3) +12 more potentially affected by CVE-2026-9335 via keras (>=3.13.0, <=3.14.1)

keras PYPI version =3.13.0, =0.1.0, =0.1.0, =0.0.1, =0.3.4, =0.2.5, =0.1.0, =0.0.1, =1.3.1, =0.2.6, =1.24.0, =1.25.0 Source cves: CVE-2026-9335 Source advisory: OSV:PYSEC-2026-3633...

ads-and (>=0.1.0, <=0.1.3), ads-bib (>=0.1.0, <=0.3.3) +12 more potentially affected by CVE-2026-12482 via keras (>=3.13.0, <=3.14.1)

keras PYPI version =3.13.0, =0.1.0, =0.1.0, =0.0.1, =0.3.4, =0.2.5, =0.1.0, =0.0.1, =1.3.1, =0.2.6, =1.24.0, =1.25.0 Source cves: CVE-2026-12482 Source advisory: GHSA-58HV-7753-XMFQ...

Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset

SummarySeveral Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the RemoteFacilityUser viewsets; remediation review found two...

PYSEC-2026-2554 Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset

Summary Several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the RemoteFacilityUser viewsets; remediation review found two...

kolibri-sentry-plugin (>=0.0.1, <=0.1.0) potentially affected by CVE-2024-40647 via sentry-sdk (0.7.9)

sentry-sdk PYPI version 0.7.9 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - kolibri-sentry-plugin =0.0.1, =0.1.0 Source cves: CVE-2024-40647 Source advisory: OSV:PYSEC-2026-1917...

kolibri-sentry-plugin (>=0.0.1, <=0.1.0) potentially affected by CVE-2023-28117 via sentry-sdk (0.7.9)

sentry-sdk PYPI version 0.7.9 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - kolibri-sentry-plugin =0.0.1, =0.1.0 Source cves: CVE-2023-28117 Source advisory: OSV:PYSEC-2026-920...

Server-side Request Forgery (SSRF)

Overview kolibri is a Kolibri - the offline app for universal education Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the baseurl parameter in several API endpoints, which is insufficiently validated and allows outbound HTTP requests to arbitrary hosts. ...

PT-2026-48808

Name of the Vulnerable Software and Affected Versions Kolibri versions prior to 0.19.4 Description Several API endpoints accept an unvalidated baseurl parameter, allowing the server to fetch attacker-controlled URLs and reflect the response body back to the caller. This occurs because the baseurl...

CVE-2026-48053

creationtimestamp| type| source ---|---|--- 2026-05-27 17:45:47+00:00| published-proof-of-concept| https://github.com/learningequality/kolibri/security/advisories/GHSA-4mj9-pf4r-cqrc...

kolibri-sentry-plugin (>=0.0.1, <=0.1.0) potentially affected by CVE-2024-40647 via sentry-sdk (0.7.9)

sentry-sdk PYPI version 0.7.9 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - kolibri-sentry-plugin =0.0.1, =0.1.0 Source cves: CVE-2024-40647 Source advisory: OSV:GHSA-G92J-QHMH-64V2...