https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 14 Nov 2026 11:47:21 +0000 https://db.gcve.eu/vuln/cleanstart-2026-zf35856 <p><strong>Affected:</strong> CleanStart: litellm-database</p> <p>Security vulnerability affects the litellm-database package. Tornado before 6.</p> <p><strong>Affected:</strong> CleanStart: litellm-database</p> <p>Security vulnerability affects the litellm-database package. Tornado before 6.</p> https://db.gcve.eu/vuln/cleanstart-2026-zf35856 https://db.gcve.eu/vuln/fkie_cve-2026-123534 <p>Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows attackers to hash files outside static_path using ../ sequences. Attackers controlling input passed to static_url() can obtain SHA-512 hashes of readable files to confirm their existence, or reference /dev/zero to block the event loop indefinitely.</p> <p>Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows attackers to hash files outside static_path using ../ sequences. Attackers controlling input passed to static_url() can obtain SHA-512 hashes of readable files to confirm their existence, or reference /dev/zero to block the event loop indefinitely.</p> https://db.gcve.eu/vuln/fkie_cve-2026-123534 https://db.gcve.eu/vuln/ghsa-xc53-2vgx-jv3x <p>Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows attackers to hash files outside static_path using ../ sequences. Attackers controlling input passed to static_url() can obtain SHA-512 hashes of readable files to confirm their existence, or reference /dev/zero to block the event loop indefinitely.</p> <p>Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows attackers to hash files outside static_path using ../ sequences. Attackers controlling input passed to static_url() can obtain SHA-512 hashes of readable files to confirm their existence, or reference /dev/zero to block the event loop indefinitely.</p> https://db.gcve.eu/vuln/ghsa-xc53-2vgx-jv3x https://db.gcve.eu/vuln/ubuntu-cve-2026-123534 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-tornado, Ubuntu:Pro:18.04:LTS: python-tornado, Ubuntu:Pro:20.04:LTS: python-tornado, Ubuntu:Pro:22.04:LTS: python-tornado, Ubuntu:24.04:LTS: python-tornado, Ubuntu:26.10: python-tornado, Ubuntu:26.04:LTS: python-tornado</p> <p>Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows attackers to hash files outside static_path using ../ sequences. Attackers controlling input passed to static_url() can obtain SHA-512 hashes of readable files to confirm their existence, or reference /dev/zero to block the event loop indefinitely.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-tornado, Ubuntu:Pro:18.04:LTS: python-tornado, Ubuntu:Pro:20.04:LTS: python-tornado, Ubuntu:Pro:22.04:LTS: python-tornado, Ubuntu:24.04:LTS: python-tornado, Ubuntu:26.10: python-tornado, Ubuntu:26.04:LTS: python-tornado</p> <p>Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows attackers to hash files outside static_path using ../ sequences. Attackers controlling input passed to static_url() can obtain SHA-512 hashes of readable files to confirm their existence, or reference /dev/zero to block the event loop indefinitely.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-123534