https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T04:19:12.239602+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-366549 EUVD-2026-366549 2026-10-06T04:19:12.287842+00:00 EUVD-2026-366549 https://cve.radiocsirt.org/vuln/fkie_cve-2026-84282 fkie_cve-2026-84282 2026-10-06T04:19:12.287880+00:00

A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated administrator can manipulate the document server parameter to cause the ownCloud server to send arbitrary requests to attacker-controlled destinations, including localhost and internal network hosts. This allows internal network reconnaissance and TCP port scanning based on differences in server responses.

 https://cve.radiocsirt.org/vuln/ghsa-wpfp-j2f8-c6vj GHSA-wpfp-j2f8-c6vj 2026-10-06T04:19:12.287916+00:00

A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated administrator can manipulate the document server parameter to cause the ownCloud server to send arbitrary requests to attacker-controlled destinations, including localhost and internal network hosts. This allows internal network reconnaissance and TCP port scanning based on differences in server responses.