PT-2026-68105

Name of the Vulnerable Software and Affected Versions DjangoCRM affected versions not specified Description The massmail module fails to sanitize user-controlled EmlMessage fields, specifically subject and content, when rendering them through the Django Template constructor. This issue occurs in...

CVE-2026-18819

A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly...

CVE-2026-18819 RackTables cross-site request forgery

A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly...

CVE-2026-18819

A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly...

CVE-2026-18819 RackTables cross-site request forgery

A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly...

CVE-2026-18819

A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly...

CVE-2026-18819

RackTables

CVE-2026-70620

Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind...

CVE-2026-70591

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...

NPM: Ghost: Server-Side Request Forgery in Image Fetching

NPM: Ghost: Server-Side Request Forgery in Image Fetching vulnerability discovered by ? in WordPress Npm ghost versions = 0.10.0, 6.54.1...

GHSA-GCVV-72Q8-9V76 Ghost: Server-Side Request Forgery in Image Fetching

Impact A Server-Side Request Forgery SSRF in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. Vulnerable versions This vulnerability is present in Ghost...

Ghost: Server-Side Request Forgery in Image Fetching

Impact A Server-Side Request Forgery SSRF in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. Vulnerable versions This vulnerability is present in Ghost...

CVE-2026-70591

Ghost is a Node.js content management system. From version 0.10.0 up to 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET to internal hosts; no output was returned but it could be used to probe internal ports. The issue is...

CVE-2026-70591 Ghost: Server-Side Request Forgery in Image Fetching

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...

CVE-2026-70591 Ghost: Server-Side Request Forgery in Image Fetching

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...

EUVD-2026-52973

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...

Ghost: Mobiledoc image-size fetch SSRF

Impact When re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card a...

GHSA-CH52-PX8Q-F22J Ghost: Server-side request forgery via DNS rebinding in external request handling

Impact Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacker to coerce the Ghost server into reaching hosts on internal networks through features that issue external fetches. Vulnerable versions This vulnerability is present in Ghost from...

Ghost: Server-side request forgery via DNS rebinding in external request handling

Impact Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacker to coerce the Ghost server into reaching hosts on internal networks through features that issue external fetches. Vulnerable versions This vulnerability is present in Ghost from...

NPM: Ghost: Server-side request forgery via DNS rebinding in external request handling

NPM: Ghost: Server-side request forgery via DNS rebinding in external request handling vulnerability discovered by ? in WordPress Npm ghost versions = 6.0.9, 6.21.1...