CVE-2026-28680

creationtimestamp| type| source ---|---|--- 2026-03-06 06:07:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgenj6wcpm2y 2026-03-06 08:06:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeu6oysy32h 2026-03-06 08:07:40+00:00| seen|...

CVE-2026-28680 Ghostfolio: Full-Read SSRF in Manual Asset Import

Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata IMDS or probe internal network services. This issue has been patched in...