https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-25T23:50:48.472267+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-116017 fkie_cve-2026-116017 2026-10-25T23:50:48.485396+00:00

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.

 https://db.gcve.eu/vuln/ghsa-2hv3-q586-pf3c GHSA-2hv3-q586-pf3c 2026-10-25T23:50:48.485471+00:00

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.