Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: jarun Clear all filters
TI-2026-85580 CVE-2026-123201 · GHSA-jrwq-3w4r-c27c

Server-side request forgery in Buku bukuserver reaches internal hosts

Priority LOW 28

Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00394 Published 2026-11-05 No fix listed CWE-918
TI-2026-84450 CVE-2026-121627 · GHSA-jx74-jhpj-pc7p

Stored cross-site scripting in buku bookmark list via bookmark URL

Priority LOW 23

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry().

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00194 Published 2026-11-03 No fix listed CWE-79
TI-2026-84356 CVE-2026-121550 · GHSA-96gh-683j-p43h

Symlink-following write in nnn via NNN_FIFO handling

Priority LOW 6

nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO.

CVSS 4.0LOW 1.0 Local Low privileges User interaction EPSS 0.00116 Published 2026-11-03 No fix listed CWE-59
TI-2026-84355 CVE-2026-121549 · GHSA-p7pp-h3gc-2v7m

nnn Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins

Priority MEDIUM 52

nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp.

CVSS 4.0MEDIUM 4.1 Local Low privileges User interaction EPSS 0.00109 Published 2026-11-03 No fix listed CWE-377
TI-2026-84354 CVE-2026-121548 · GHSA-8pw3-3g5c-862j

OS command injection in nnn togglex plugin via crafted filenames

Priority HIGH 72

Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames.

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.01152 Published 2026-11-03 No fix listed CWE-78
TI-2025-12396 CVE-2025-13566 · GHSA-mggq-rppf-vgmq

jarun nnn nnn.c run_cmd_as_plugin double free

Priority LOW 21

A security vulnerability has been detected in jarun nnn up to 5.1.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00145 Published 2025-11-23 No fix listed CWE-119