CVE ID :CVE-2026-59707 Published : July 7, 2026, 8:37 p.m. | 37 minutes ago Description :LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized...

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-59707 - LocalAI - Server-Side Request Forgery via POST /models/apply

VERWANDTEARTIKEL

CVE-2026-59706 - mem0 - Server-Side Request Forgery and Plaintext API Key Exposure via Unauthenticated Config Endpoints

CVE-2026-55408 - Koodo Reader: Remote code execution via malicious epub file

CVE-2026-55418 - FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)

CVE-2026-42958 - Use After Free in Labcenter Proteus

CVE-2026-46354 - Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

CVE-2026-49033 - Stack-Based Buffer Overflow in Labcenter Proteus