Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-123201

buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API

Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jarun
Products
Buku
CVE-2026-121627

buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jarun
Products
Buku