CVE-2026-103437

CVE-2026-103437: ReadingLists imported canonical URL XSS Reporter: Marco Paciaroni BomboBombone. ReadingLists accepted an imported project URL and used the response's canonicalurl as a card link without checking its scheme. A signed-in visitor who opened a crafted import link and clicked the card...

Exploit for CVE-2026-103437

CVE-2026-103437: ReadingLists imported canonical URL XSS Repo...

CVE-2018-14716

A Server Side Template Injection SSTI was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code...