170261 matches found
CVE-2026-72591
The CVE-2026-72591 entry describes a server-side request forgery (SSRF) in the gabehf/Koito project up to v0.3.2. An authenticated user can supply a crafted image_url in PATCH /apis/web/v1/album/{id}/image, causing the server to perform HTTP requests to arbitrary internal or external hosts. The i...
EUVD-2026-55215
A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...
CVE-2026-72591 Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter
A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...
CVE-2026-72591
A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...
CVE-2026-72581 duhow xiaoai-patch - Server-Side Request Forgery in /auth Endpoint
A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...
CVE-2026-72581
A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...
EUVD-2026-55225
A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...
CVE-2026-72580 duhow xiaoai-patch - OS Command Injection in /mute and /unmute Endpoints
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...
CVE-2026-72580 duhow xiaoai-patch - OS Command Injection in /mute and /unmute Endpoints
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...
EUVD-2026-55226
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...
CVE-2026-72580
The CVE-2026-72580 entry details an OS command injection in the duhow/xiaoai-patch for Xiaomi smart speakers running the patch. The vulnerability arises because the /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without san...
CVE-2026-72580
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...
CLSA-2026-1786358468 TuxCare security update for 123 packages (2 CVEs)
TuxCare rebuilt 123 packages to address 2 CVEs. Fixed in 10.0.28.tuxcare0003...
Security Bulletin:Vulnerability in libtiff affects IBM Netezza Appliance
Summary The libtiff package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVEs CVE-2023-52355, CVE-2025-9900, CVE-2025-8176 Vulnerability Details CVEID:CVE-2023-52355 DESCRIPTION: An out-of-memory flaw was found in libtiff that could be triggered by passing...
Security Bulletin:Vulnerability in React affects IBM Netezza Appliance
Summary The React package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-33244, CVE-2026-33245, CVE-2026-34077, CVE-2026-40181, CVE-2026-42211, CVE-2026-42342 Vulnerability Details CVEID:CVE-2026-33244 DESCRIPTION: React Router is a router for...
CLSA-2026-1786355016 TuxCare security update for ch.qos.logback (1 CVE)
TuxCare rebuilt 6 ch.qos.logback packages to address 1 CVE. Fixed in 1.2.3-tuxcare.1...
CLSA-2026-1786342108 TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 21 org.springframework packages to address 4 CVEs. Fixed in 4.3.9.RELEASE-tuxcare.3...
Exploit for CVE-2026-64564
SCTPhantom — Linux kernel SCTP ASCONF use-after-free tracking...
CVE-2026-72581: Server-Side Request Forgery (SSRF)
A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...
Photon OS 5.0: Python3 PHSA-2024-5.0-91-0223
An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0223. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...