https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T08:42:56.637215+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-73629 CVE-2026-73629 — Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses 2026-10-08T08:42:56.653025+00:00

Affected: s9y Serendipity

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.