CWE-367
CWE-367 · 4 records · 4 with a public proof-of-concept
Records the NVD classes under CWE-367, highest CVSS first.
- HIGH 8.5CVE-2026-71272public PoC
Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the origin…
- MEDIUM 6.5CVE-2026-47621public PoC
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this vulnerability might lead to denial of service and data tampering.
dynamo · linux kernel
- MEDIUM 6.3CVE-2026-54020public PoC
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname aga…
- MEDIUM 5.3CVE-2026-71210public PoC
Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying a…