https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T18:23:26.832147+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-380399 EUVD-2026-380399 2026-10-07T18:23:26.882544+00:00 EUVD-2026-380399 https://cve.radiocsirt.org/vuln/fkie_cve-2026-73315 fkie_cve-2026-73315 2026-10-07T18:23:26.882583+00:00

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme, hostname, or allowlist validation. Attackers can submit a crafted POST to the PayPal webhook callback endpoint to reach internal network resources including cloud instance metadata services, potentially disclosing IAM credentials or enabling secondary internal service exploitation.

 https://cve.radiocsirt.org/vuln/ghsa-x4fx-w4wf-c38c GHSA-x4fx-w4wf-c38c 2026-10-07T18:23:26.882618+00:00

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme, hostname, or allowlist validation. Attackers can submit a crafted POST to the PayPal webhook callback endpoint to reach internal network resources including cloud instance metadata services, potentially disclosing IAM credentials or enabling secondary internal service exploitation.