https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 09:33:32 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-234144 EUVD-2026-234144 https://cve.radiocsirt.org/vuln/euvd-2026-234144 https://cve.radiocsirt.org/vuln/fkie_cve-2022-29180 <p>A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. This has been patched and is available in release [v0.12.1](https://github.com/charmbracelet/charm/releases/tag/v0.12.1). We recommend that all users running self-hosted `charm` instances update immediately. This vulnerability was found in-house and we haven&#39;t been notified of any potential exploiters. ### Additional notes * Encrypted user data uploaded to the Charm server is safe as Charm servers cannot decrypt user data. This includes filenames, paths, and all key-value data. * Users running the official Charm [Docker images](https://github.com/charmbracelet/charm/blob/main/docker.md) are at minimal risk because the exploit is limited to the containerized filesystem.</p> <p>A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. This has been patched and is available in release [v0.12.1](https://github.com/charmbracelet/charm/releases/tag/v0.12.1). We recommend that all users running self-hosted `charm` instances update immediately. This vulnerability was found in-house and we haven&#39;t been notified of any potential exploiters. ### Additional notes * Encrypted user data uploaded to the Charm server is safe as Charm servers cannot decrypt user data. This includes filenames, paths, and all key-value data. * Users running the official Charm [Docker images](https://github.com/charmbracelet/charm/blob/main/docker.md) are at minimal risk because the exploit is limited to the containerized filesystem.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-29180 https://cve.radiocsirt.org/vuln/ghsa-4wpp-w5r4-7v5v <p><strong>Affected:</strong> Go: github.com/charmbracelet/charm</p> <p>We&#39;ve discovered a vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. This has been patched in https://github.com/charmbracelet/charm/commit/3c90668f955c7ce5ef721e4fc9faee7053232fd3 and is available in release [v0.12.1](https://github.com/charmbracelet/charm/releases/tag/v0.12.1). We recommend that all users running self-hosted `charm` instances update immediately.</p> <p>This vulnerability was found in-house and we haven&#39;t been notified of any potential exploiters.</p> <p>### Additional notes</p> <p>* Encrypted user data uploaded to the Charm server is safe as Charm servers cannot decrypt user data. This includes filenames, paths, and all key-value data. * Users running the official Charm [Docker images](https://github.com/charmbracelet/charm/blob/main/docker.md) are at minimal risk because the exploit is limited to the containerized filesystem.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory: * Open a [discussion](https://github.com/charmbracelet/charm/discussions) * Email us at [vt100@charm.sh](mailto:vt100@charm.sh) * Chat with us on [Slack](https://charm.sh/slack)</p> <p>* * *</p> <p>&lt;a href=&#34;https://charm.sh/&#34;&gt;&lt;img alt=&#34;the Charm logo&#34; src=&#34;https://stuff.charm.sh/charm-badge.jpg&#34; width=&#34;400&#34;&gt;&lt;/a&gt;</p> <p>Charm热爱开源 • Charm loves open source</p> <p><strong>Affected:</strong> Go: github.com/charmbracelet/charm</p> <p>We&#39;ve discovered a vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. This has been patched in https://github.com/charmbracelet/charm/commit/3c90668f955c7ce5ef721e4fc9faee7053232fd3 and is available in release [v0.12.1](https://github.com/charmbracelet/charm/releases/tag/v0.12.1). We recommend that all users running self-hosted `charm` instances update immediately.</p> <p>This vulnerability was found in-house and we haven&#39;t been notified of any potential exploiters.</p> <p>### Additional notes</p> <p>* Encrypted user data uploaded to the Charm server is safe as Charm servers cannot decrypt user data. This includes filenames, paths, and all key-value data. * Users running the official Charm [Docker images](https://github.com/charmbracelet/charm/blob/main/docker.md) are at minimal risk because the exploit is limited to the containerized filesystem.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory: * Open a [discussion](https://github.com/charmbracelet/charm/discussions) * Email us at [vt100@charm.sh](mailto:vt100@charm.sh) * Chat with us on [Slack](https://charm.sh/slack)</p> <p>* * *</p> <p>&lt;a href=&#34;https://charm.sh/&#34;&gt;&lt;img alt=&#34;the Charm logo&#34; src=&#34;https://stuff.charm.sh/charm-badge.jpg&#34; width=&#34;400&#34;&gt;&lt;/a&gt;</p> <p>Charm热爱开源 • Charm loves open source</p> https://cve.radiocsirt.org/vuln/ghsa-4wpp-w5r4-7v5v https://cve.radiocsirt.org/vuln/gsd-2022-29180 gsd-2022-29180 https://cve.radiocsirt.org/vuln/gsd-2022-29180