https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 00:43:20 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349662 EUVD-2026-349662 https://cve.radiocsirt.org/vuln/euvd-2026-349662 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71270 <p>Stirling-PDF&#39;s POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf).</p> <p>Stirling-PDF&#39;s POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71270 https://cve.radiocsirt.org/vuln/ghsa-j5rg-wh78-9f2q <p>Stirling-PDF&#39;s POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf). The endpoint validates only that the initial requested URL resolves to a public IP, then fetches the page&#39;s HTML server-side and hands it, unsanitized, to a WeasyPrint subprocess. Embedded resource references in the fetched HTML (e.g. `&lt;img src=&#34;http://169.254.169.254/...&#34;&gt;`) are fetched by WeasyPrint with no per-resource SSRF filtering, allowing an attacker-controlled page to cause the server to retrieve cloud metadata endpoints or internal network resources and leak their contents back into the generated PDF.</p> <p>Stirling-PDF&#39;s POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf). The endpoint validates only that the initial requested URL resolves to a public IP, then fetches the page&#39;s HTML server-side and hands it, unsanitized, to a WeasyPrint subprocess. Embedded resource references in the fetched HTML (e.g. `&lt;img src=&#34;http://169.254.169.254/...&#34;&gt;`) are fetched by WeasyPrint with no per-resource SSRF filtering, allowing an attacker-controlled page to cause the server to retrieve cloud metadata endpoints or internal network resources and leak their contents back into the generated PDF.</p> https://cve.radiocsirt.org/vuln/ghsa-j5rg-wh78-9f2q