CVE-2026-78850

Matomo Authenticated SiteContentDetector Blind SSRF Reporter Name: CYBER-SEC Contact: [email protected] Summary Matomo allows an authenticated site administrator to configure a site's mainurl with an internal address. Any authenticated user with view access can later trigger...

OPENSUSE-SU-2026:12228-1 matomo-5.14.2-1.1 on GA media

These are all security issues fixed in the matomo-5.14.2-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-122452

These are all security issues fixed in the matomo-5.14.2-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-78850

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set mainurl to a URL that...

UBUNTU-CVE-2026-78850

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component...

CVE-2026-78850

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component...

Linux Distros Unpatched Vulnerability : CVE-2026-78850

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component CVE-2026-78850 Note th...

DEBIAN-CVE-2026-78850

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set mainurl to a URL that...

CVE-2026-78850

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set mainurl to a URL that...

CVE-2026-78850

Matomo v.5.11.2 is vulnerable to a Blind Server-Side Request Forgery (SSRF) (CWE-918) in the SiteContentDetector / SitesManager component. The issue arises because the application allows an authenticated site administrator to configure a main_url that points to an internal address. The system per...

CVE-2026-78850

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set mainurl to a URL that...

PT-2026-115011

Name of the Vulnerable Software and Affected Versions Matomo version 5.11.2 Description An issue in the SiteContentDetector / SitesManager component allows a remote attacker to obtain sensitive information. Recommendations At the moment, there is no information about a newer version that contains...

CVE-2026-78850: Server-Side Request Forgery (SSRF)

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component...

CVE-2026-78850

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set mainurl to a URL that...

CVE-2026-78850

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set mainurl to a URL that...

EUVD-2026-102185

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component...

CVE-2026-96564

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

EUVD-2026-91905

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-96564

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 10.2 . The root cause is insufficient input sanitization and output escaping of the Author Display Name. An unauthenticated attacker can inject ar...

CVE-2026-96564 SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...