CVE-2026-104464

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

CVE-2026-104459

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actorhandle with a numeric host and port to the abonnements view to probe internal HTTPS...

CVE-2026-104464 YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

EUVD-2026-91475

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

CVE-2026-104464

YesWiki versions prior to 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to force the server to make GET requests by providing an unvalidated actor URL within the Bazar abonnements sync action. Exploitation enables attackers ...

CVE-2026-104464 YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

CVE-2026-104464 YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

CVE-2026-104459

Versions of YesWiki prior to 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) in the WebfingerService component. Unauthenticated attackers can exploit this by sending a POST request containing a crafted actor_handle with a numeric host and port to the abonnements view. This allows the...

CVE-2026-104459 YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actorhandle with a numeric host and port to the abonnements view to probe internal HTTPS...

CVE-2026-104459 YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actorhandle with a numeric host and port to the abonnements view to probe internal HTTPS...

CVE-2026-104459 YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actorhandle with a numeric host and port to the abonnements view to probe internal HTTPS...

EUVD-2026-91470

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actorhandle with a numeric host and port to the abonnements view to probe internal HTTPS...

CVE-2026-104459: Server-Side Request Forgery (SSRF)

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actorhandle with a numeric host and port to the abonnements view to probe internal HTTPS...

PT-2026-104274

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

CVE-2026-104464: Server-Side Request Forgery (SSRF)

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

PT-2026-104269

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actor handle with a numeric host and port to the abonnements view to probe internal HTTPS...