https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T20:03:40.081640+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-384475 EUVD-2026-384475 2026-10-09T20:03:40.083955+00:00 EUVD-2026-384475 https://cve.radiocsirt.org/vuln/fkie_cve-2026-107449 fkie_cve-2026-107449 2026-10-09T20:03:40.083987+00:00

linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.

 https://cve.radiocsirt.org/vuln/ghsa-hrj5-rw8j-34qj GHSA-hrj5-rw8j-34qj 2026-10-09T20:03:40.084021+00:00

linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.