Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 11:10:36 +0000 EUVD-2026-322758 https://cve.radiocsirt.org/vuln/euvd-2026-322758 EUVD-2026-322758 https://cve.radiocsirt.org/vuln/euvd-2026-322758 fkie_cve-2026-45619 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45619 <p>WWBN AVideo is an open source video platform. In 29.0 and earlier, EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations do not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE, opening DNS-rebinding TOCTOU.</p> <p>WWBN AVideo is an open source video platform. In 29.0 and earlier, EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations do not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE, opening DNS-rebinding TOCTOU.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45619 GHSA-c3ch-22rq-xfwr — AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-p… https://cve.radiocsirt.org/vuln/ghsa-c3ch-22rq-xfwr <p><strong>Affected:</strong> Packagist: WWBN/AVideo</p> <p>CVE-2026-43884 fix `603e7bf` patched `EpgParser.php` and `plugin/AI/receiveAsync.json.php` to use `url_get_contents` (redirect-safe). Neither uses the `$resolvedIP` out-param of `isSSRFSafeURL()` for DNS pinning via `CURLOPT_RESOLVE`. Six+ other call sites still discard `$resolvedIP`, opening DNS-rebinding TOCTOU.</p> <p>Reference correct pattern at `plugin/YPTWallet/YPTWallet.php:1071-1098`:</p> <p>```php $resolvedIP = null; if (isSSRFSafeURL($url, $resolvedIP)) { curl_setopt($ch, CURLOPT_RESOLVE, [&#34;$h</p> <p><strong>Affected:</strong> Packagist: WWBN/AVideo</p> <p>CVE-2026-43884 fix `603e7bf` patched `EpgParser.php` and `plugin/AI/receiveAsync.json.php` to use `url_get_contents` (redirect-safe). Neither uses the `$resolvedIP` out-param of `isSSRFSafeURL()` for DNS pinning via `CURLOPT_RESOLVE`. Six+ other call sites still discard `$resolvedIP`, opening DNS-rebinding TOCTOU.</p> <p>Reference correct pattern at `plugin/YPTWallet/YPTWallet.php:1071-1098`:</p> <p>```php $resolvedIP = null; if (isSSRFSafeURL($url, $resolvedIP)) { curl_setopt($ch, CURLOPT_RESOLVE, [&#34;$h</p> https://cve.radiocsirt.org/vuln/ghsa-c3ch-22rq-xfwr