https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T17:30:08.251366+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-322758 EUVD-2026-322758 2026-10-08T17:30:08.314048+00:00 EUVD-2026-322758 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45619 fkie_cve-2026-45619 2026-10-08T17:30:08.314093+00:00

WWBN AVideo is an open source video platform. In 29.0 and earlier, EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations do not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE, opening DNS-rebinding TOCTOU.

 https://cve.radiocsirt.org/vuln/ghsa-c3ch-22rq-xfwr GHSA-c3ch-22rq-xfwr — AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-p… 2026-10-08T17:30:08.314130+00:00

Affected: Packagist: WWBN/AVideo

CVE-2026-43884 fix `603e7bf` patched `EpgParser.php` and `plugin/AI/receiveAsync.json.php` to use `url_get_contents` (redirect-safe). Neither uses the `$resolvedIP` out-param of `isSSRFSafeURL()` for DNS pinning via `CURLOPT_RESOLVE`. Six+ other call sites still discard `$resolvedIP`, opening DNS-rebinding TOCTOU.

Reference correct pattern at `plugin/YPTWallet/YPTWallet.php:1071-1098`:

```php $resolvedIP = null; if (isSSRFSafeURL($url, $resolvedIP)) { curl_setopt($ch, CURLOPT_RESOLVE, ["$h