https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T23:03:22.856206+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/fkie_cve-2026-40500 fkie_cve-2026-40500 2026-10-18T23:03:22.857978+00:00

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The "Add Module from URL" feature requires superuser privileges (root-equivalent in ProcessWire) who already has unrestricted arbitrary code execution via standard module upload, making the SSRF vector incapable of providing incremental attack surface. The feature is also disabled by default and requires direct filesystem access to enable.

 https://cve.radiocsirt.org/vuln/ghsa-gmwr-9j4p-96vm GHSA-gmwr-9j4p-96vm — ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature 2026-10-18T23:03:22.858026+00:00

Affected: Packagist: processwire/processwire

ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature that allows authenticated administrators to supply arbitrary URLs to the module download parameter, causing the server to issue outbound HTTP requests to attacker-controlled internal or external hosts. Attackers can exploit differentiable error messages returned by the server to perform reliable internal network port scanning, host enumeration across RFC-1918 ranges, and potential access to cloud instance metadata endpoints.