CVE-2026-55598 PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/addpodcast in rust-api/src/handlers/podcasts.rs. getpodcastvalues and addepisodes in rust-api/src/database.r...

CVE-2026-55598 PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/addpodcast in rust-api/src/handlers/podcasts.rs. getpodcastvalues and addepisodes in rust-api/src/database.r...

EUVD-2026-114370

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/addpodcast in rust-api/src/handlers/podcasts.rs. getpodcastvalues and addepisodes in rust-api/src/database.r...

CVE-2026-55598 PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/addpodcast in rust-api/src/handlers/podcasts.rs. getpodcastvalues and addepisodes in rust-api/src/database.r...

CVE-2026-55598

The PinePods podcast management system (prior to version 0.9.0 ) is vulnerable to Server-Side Request Forgery (SSRF) . An authenticated user can subscribe to a malicious RSS feed via POST /api/data/add_podcast, causing the system to parse and store values without host or IP validation. When down...

PT-2026-134171

Name of the Vulnerable Software and Affected Versions PinePods versions prior to 0.9.0 Description An authenticated user can trigger server-side requests to internal loopback, private-network, and cloud metadata services. This occurs when the system processes an attacker-controlled RSS feed via t...

CVE-2026-55598: madeofpendletonwool PinePods: PinePods is a complete, self-hosted podcast management system written in Rust

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/addpodcast in rust-api/src/handlers/podcasts.rs. getpodcastvalues and addepisodes in rust-api/src/database.r...

CVE-2026-55177

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-85612 OpenPanel before 2.3.0 SSRF via favicon and og endpoints

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata...

CVE-2026-85612: Server-Side Request Forgery (SSRF)

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata...

CVE-2026-84175

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...

CVE-2026-84175

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...

CVE-2026-84175

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...

EUVD-2026-69894

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...

CVE-2026-84175

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...

CVE-2026-84175

Eclipse Ditto versions 3.0.0 through 3.9.6 (and 2.4.0–2.5.x when the WoT integration feature toggle is explicitly enabled) are affected by a Server-Side Request Forgery (SSRF) in the Things service. The service fetches WoT ThingModels over HTTP from URLs supplied by API users without validating t...

CVE-2026-72784: Server-Side Request Forgery (SSRF)

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT...

CVE-2026-51833: Server-Side Request Forgery (SSRF)

Xenforo 2.3.8 is vulnerable to SSRF. Attackers that have administrator privileges or are able to add/save RSS feeds can enumerate internal services ports or expose the original IP address of the server...

CVE-2026-63306: Server-Side Request Forgery (SSRF)

stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and rea...

PT-2026-35302

Summary The attacker provides an intranet address through the base url field configured in the Execute Flow node → Bypass checkDenyList / resolveAndValidate in httpSecurity.ts not called → Causes the server to initiate an HTTP request to any internal network address, read cloud metadata, or detec...