CVE-2026-72597

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

CVE-2026-72597 Friendica Friendica - Server-Side Request Forgery

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

CVE-2026-72597

CVE-2026-72597 affects Friendica (2026.08-dev branch). The vulnerability is a server-side request forgery (SSRF) in the link-preview endpoint, which fetches a user-provided URL without an internal IP deny list. This allows an authenticated user with a free self-registered account to probe interna...

EUVD-2026-56036

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

CVE-2026-72597

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

CVE-2026-72597 Friendica Friendica - Server-Side Request Forgery

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

CVE-2026-72540

This CVE was rejected by Red Hat CNA-LR as not valid. However, EUVD and PT Security describe an insecure direct object reference (IDOR) in PhotoPrism through commit bb0b933. The AlbumCover handler does not verify that the requesting user is authorized to access the specified album before serving ...

CVE-2026-72540

...

CVE-2026-72540

...

CVE-2026-72540

Red Hat CNA-LR concluded that this CVE is not valid...

PT-2026-70141

Name of the Vulnerable Software and Affected Versions Friendica versions prior to 2026.08-dev Description An authenticated user with a self-registered account can perform a server-side request forgery SSRF through the link-preview endpoint. This occurs because the endpoint fetches user-supplied...

CVE-2026-72597: Server-Side Request Forgery (SSRF)

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

PT-2026-70115

An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo of any album. The AlbumCover handler does not verify that the requesting user is authorized to access the specified alb...

PT-2026-70911

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an...

arkindex-base-worker (>=0.3.7rc2, <=0.3.7rc10), mafiagg (>=1.0.0, <=1.0.4) +1 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.7.0)

pymdown-extensions PYPI version 10.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.7rc2, =1.0.0, =0.2.54, =0.2.65 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...

iga (1.3.0), labext-pkg (2.3.1) +2 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.8.1)

pymdown-extensions PYPI version 10.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - iga 1.3.0 - labext-pkg 2.3.1 - markdown-live-preview =0.2.67, =12.0.25, =12.0.26 Source cves: CVE-2026-67422 Source advisor...

arkindex-base-worker (>=0.3.6, <=0.3.7rc1), markdown-live-preview (>=0.2.48, <=0.2.53) +1 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.5.0)

pymdown-extensions PYPI version 10.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.6, =0.2.48, =0.11.0, =0.12.2 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...

edubotics-core (>=0.1.3, <=0.1.7), lexical-workspace (>=0.1.0, <=0.2.0) +5 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.9.0)

pymdown-extensions PYPI version 10.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - edubotics-core =0.1.3, =0.1.0, =12.0.27, =1.0.1a4, =1.0.0, =1.2.4 Source cves: CVE-2026-67422 Source advisory:...

CVE-2026-16957: Authorization Bypass Through User-Controlled Key

The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...

Vercel / Netlify Preview Production Secrets Detection

Detects Vercel git previews, Netlify deploy-preview URLs, and staging subdomains that embed production API keys, database URLs, or Supabase servicerole tokens in client-side assets. Also flags VERCELENV=production / NETLIFYCONTEXT=production on non-production deploys. !/usr/bin/env python3 --...