https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T19:35:20.402455+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-264924 EUVD-2026-264924 2026-10-08T19:35:20.449955+00:00 EUVD-2026-264924 https://cve.radiocsirt.org/vuln/fkie_cve-2025-67427 fkie_cve-2025-67427 2026-10-08T19:35:20.450004+00:00

A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API. The vulnerability occurs due to insufficient validation of the "src" query parameter, which permits arbitrary HTTP or HTTPS URIs, resulting in unexpected requests against internal and external networks.

 https://cve.radiocsirt.org/vuln/ghsa-vp8w-wj4m-3r7j GHSA-vp8w-wj4m-3r7j — evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API 2026-10-08T19:35:20.450041+00:00

Affected: npm: @evershop/evershop

A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API. The vulnerability occurs due to insufficient validation of the "src" query parameter, which permits arbitrary HTTP or HTTPS URIs, resulting in unexpected requests against internal and external networks.