https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T10:35:20.200604+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-335222 EUVD-2026-335222 2026-10-08T10:35:20.246502+00:00 EUVD-2026-335222 https://cve.radiocsirt.org/vuln/fkie_cve-2026-12517 fkie_cve-2026-12517 2026-10-08T10:35:20.246538+00:00

The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated site-info endpoint before fetching it, allowing anonymous users (the gating nonce is exposed on public pages carrying an embed) to make the site request internal and private-network URLs and read back the parsed page metadata. This is a Server-Side Request Forgery.

 https://cve.radiocsirt.org/vuln/ghsa-9x4j-8g3j-786h GHSA-9x4j-8g3j-786h 2026-10-08T10:35:20.246570+00:00

The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated site-info endpoint before fetching it, allowing anonymous users (the gating nonce is exposed on public pages carrying an embed) to make the site request internal and private-network URLs and read back the parsed page metadata. This is a Server-Side Request Forgery.