buku vulnerabilities
CVEs whose affected-version data names the buku package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-123201Medium· 5.3buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API
Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_…
▾ Sunlitjarun · bukuvia CVEORG
CVE-2026-121627Medium· 6.1buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL
buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a …
▾ Sunlitjarun · bukuEPSS 0.19%via CVEORG