https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T14:02:18.421835+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-336762 EUVD-2026-336762 2026-10-07T14:02:18.424331+00:00 EUVD-2026-336762 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39922 fkie_cve-2026-39922 2026-10-07T14:02:18.424364+00:00

GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.

 https://cve.radiocsirt.org/vuln/ghsa-hw9r-6m78-w6h3 GHSA-hw9r-6m78-w6h3 — GeoNode contains a server-side request forgery vulnerability in the service registration endpoint 2026-10-07T14:02:18.424397+00:00

Affected: PyPI: geonode

GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.

 https://cve.radiocsirt.org/vuln/pysec-2026-61 PYSEC-2026-61 2026-10-07T14:02:18.424424+00:00

Affected: PyPI: geonode

GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.