https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T14:11:10.762047+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-163157 EUVD-2026-163157 2026-10-06T14:11:10.817692+00:00 EUVD-2026-163157 https://cve.radiocsirt.org/vuln/fkie_cve-2024-36471 fkie_cve-2024-36471 2026-10-06T14:11:10.817735+00:00

Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL.  Project administrators can run these imports, which could cause Allura to read from internal services and expose them.

This issue affects Apache Allura from 1.0.1 through 1.16.0.

Users are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.

 https://cve.radiocsirt.org/vuln/ghsa-2q7f-pr29-qfh5 GHSA-2q7f-pr29-qfh5 2026-10-06T14:11:10.817775+00:00

Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL.  Project administrators can run these imports, which could cause Allura to read from internal services and expose them.

This issue affects Apache Allura from 1.0.1 through 1.16.0.

Users are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.