CVE-2026-123201Medium· 5.3▾ SunlitBuku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.
buku <= 5.1.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-121627Medium· 6.1buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL
CVE-2025-68616High· 7.5WeasyPrint helps web developers to create PDF documents
CVE-2026-121548High· 7.8nnn through 5.3 OS Command Injection via togglex Plugin
CVE-2026-121550Low· 3.3nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling
CVE-2026-121549Medium· 4.4nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins
CVE-2025-61916High· 7.9Spinnaker is an open source, multi-cloud continuous delivery platform