https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T07:17:43.243953+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-333223 EUVD-2026-333223 2026-10-04T07:17:43.317679+00:00 EUVD-2026-333223 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39087 fkie_cve-2026-39087 2026-10-04T07:17:43.317727+00:00

ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.

 https://cve.radiocsirt.org/vuln/ghsa-pqhx-w72w-m393 GHSA-pqhx-w72w-m393 — ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function 2026-10-04T07:17:43.317762+00:00

Affected: Go: heckel.io/ntfy/v2

An issue in Ntfy ntfy.sh before v.2.22.0 allows a remote attacker to execute arbitrary code via the parseActions function.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-39087 UBUNTU-CVE-2026-39087 2026-10-04T07:17:43.317787+00:00

Affected: Ubuntu:25.10: ntfy, Ubuntu:Pro:26.04:LTS: ntfy

ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.