https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T09:44:14.108178+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-340425 EUVD-2026-340425 2026-10-06T09:44:14.155582+00:00 EUVD-2026-340425 https://cve.radiocsirt.org/vuln/fkie_cve-2026-8661 fkie_cve-2026-8661 2026-10-06T09:44:14.155631+00:00

Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin on Linux in versions prior to 4.0.2 allows remote attackers to make arbitrary outbound HTTP requests via unsanitized resource-loading HTML elements (img/src, CSS url(), @import) embedded in Markdown input. The initial fix in 4.0.0 disabled JavaScript but did not neutralize resource-loading vectors. Resolved in 4.0.2 by sanitizing HTML with an allowlist of tags, attributes, and URL schemes.

 https://cve.radiocsirt.org/vuln/ghsa-6r62-qf74-xpgg GHSA-6r62-qf74-xpgg 2026-10-06T09:44:14.155667+00:00

Server-Side Cross-Site Scripting and Server-Side Request Forgery vulnerability in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin version 3.1.4 and earlier on Linux allows remote attackers to execute JavaScript server-side and make arbitrary outbound HTTP requests via crafted content embedded in Markdown input. The PDF rendering engine does not restrict script execution or outbound network access.