10 matches found
CVE-2026-89003
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the...
EUVD-2026-87894
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the...
CVE-2026-89003 WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the...
EUVD-2026-87892
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only...
CVE-2026-86207: Authentication Bypass by Primary Weakness
An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal only APIs...
CVE-2026-54562: Server-Side Request Forgery (SSRF)
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or...
CVE-2024-7207
A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients when pass-through routes are used for the ingress gateway. This issue could allow a malicious user to forge what is logged by Envoy as a requested path and cause the Envoy proxy to make requests to...
CVE-2024-7207
Rejected reason: Duplicate of CVE-2024-45806...
Storefront 3.7 console displays Store as Internal Only
Question: After upgrade to Storefront 3.7 the store is displayed as Internal Only. In the details it shows Remote Access as Enabled and it also works with Netscaler Gateway. Answer: This is a known issue in Storefront 3.7 and is also mentioned in the edocs...