168329 matches found
CVE-2026-72591
A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...
CVE-2026-72581
A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...
CVE-2026-72580
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...
Security update for gd
This update for gd fixes the following issue: CVE-2026-9672: security issues in libgd bsc1273101. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product:...
Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance
Summary The Netty package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-48006 Vulnerability Details CVEID:CVE-2026-48006 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to versions...
Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance
Summary The Netty package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-44249 Vulnerability Details CVEID:CVE-2026-44249 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. In netty-handler prior...
pypdf: Possible long runtimes/large memory usage for large CID font width ranges
ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the font width entries of a font with unusually large values, for example during text extraction. PatchesThis has been fixed in pypdf==6.15.0. Workarounds...
CVE-2026-72591
The CVE-2026-72591 entry describes a server-side request forgery (SSRF) in the gabehf/Koito project up to v0.3.2. An authenticated user can supply a crafted image_url in PATCH /apis/web/v1/album/{id}/image, causing the server to perform HTTP requests to arbitrary internal or external hosts. The i...
CVE-2026-72591 Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter
A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...
EUVD-2026-55215
A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...
CVE-2026-72591
A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...
EUVD-2026-55225
A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...
CVE-2026-72580 duhow xiaoai-patch - OS Command Injection in /mute and /unmute Endpoints
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...
CVE-2026-72580
The CVE-2026-72580 entry details an OS command injection in the duhow/xiaoai-patch for Xiaomi smart speakers running the patch. The vulnerability arises because the /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without san...
EUVD-2026-55226
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...
Security Bulletin:Vulnerability in React affects IBM Netezza Appliance
Summary The React package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-33244, CVE-2026-33245, CVE-2026-34077, CVE-2026-40181, CVE-2026-42211, CVE-2026-42342 Vulnerability Details CVEID:CVE-2026-33244 DESCRIPTION: React Router is a router for...
CLSA-2026-1786355016 TuxCare security update for ch.qos.logback (1 CVE)
TuxCare rebuilt 6 ch.qos.logback packages to address 1 CVE. Fixed in 1.2.3-tuxcare.1...
CLSA-2026-1786342108 TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 21 org.springframework packages to address 4 CVEs. Fixed in 4.3.9.RELEASE-tuxcare.3...
