https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T20:58:03.300955+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-19913 fkie_cve-2026-19913 2026-10-01T20:58:03.341196+00:00

The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.

 https://vulnerability.circl.lu/vuln/ghsa-7hc5-vghm-cr8h GHSA-7hc5-vghm-cr8h 2026-10-01T20:58:03.341262+00:00

The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.

 https://vulnerability.circl.lu/vuln/rhsa-2026:69539 RHSA-2026:69539 — Red Hat Security Advisory: RHOAI 3.5.1 - Red Hat OpenShift AI 2026-10-01T20:58:03.341288+00:00

sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue sqlparse: sqlparse: Denial of Service via inefficient SQL parsing nltk: NLTK: Information Disclosure via Symlink Sandbox Bypass aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution gitpython: GitPython: Arbitrary file creation via path traversal in .gitmodules submodule names nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors nltk: NLTK: Denial of Service via unvalidated regular expressions nltk: nltk PorterStemmer: Denial of Service due to inefficient token processing nltk: NLTK: Denial of Service via Uncontrolled Recursion nltk: NLTK: Filesystem containment bypass allows local file overwrite