https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T08:30:35.322986+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-16268 CVE-2026-16268 — Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler 2026-10-08T08:30:35.342684+00:00

Affected: Unknown Newsletters

The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.