https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T00:00:49.750451+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349076 EUVD-2026-349076 2026-10-19T00:00:49.752640+00:00 EUVD-2026-349076 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18359 fkie_cve-2026-18359 2026-10-19T00:00:49.752672+00:00

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the mets_uri or iiif_uri parameter of POST /api/documents/{pk}/imports/, because the IMPORT_ALLOWED_DOMAINS setting defaults to '*' and no address filtering, redirect cap or timeout is applied

 https://cve.radiocsirt.org/vuln/ghsa-cpqx-fhwg-cr7g GHSA-cpqx-fhwg-cr7g 2026-10-19T00:00:49.752703+00:00

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the mets_uri or iiif_uri parameter of POST /api/documents/{pk}/imports/, because the IMPORT_ALLOWED_DOMAINS setting defaults to '*' and no address filtering, redirect cap or timeout is applied