https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 15:31:03 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-351114 EUVD-2026-351114 https://cve.radiocsirt.org/vuln/euvd-2026-351114 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72784 <p>Craft CMS versions &gt;= 5.0.0-RC1 before 5.10.6 and &gt;= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save&lt;Volume&gt;Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp() does not cover CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, and the only IP check runs after the request has already been issued. An attacker holding a GraphQL token scoped only to asset-creation permissions can disclose internal HTTP content from CGNAT/NAT64 targets, force outbound GET requests to internal hosts (including RFC1918, loopback, and metadata endpoints), and enumerate internal services.</p> <p>Craft CMS versions &gt;= 5.0.0-RC1 before 5.10.6 and &gt;= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save&lt;Volume&gt;Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp() does not cover CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, and the only IP check runs after the request has already been issued. An attacker holding a GraphQL token scoped only to asset-creation permissions can disclose internal HTTP content from CGNAT/NAT64 targets, force outbound GET requests to internal hosts (including RFC1918, loopback, and metadata endpoints), and enumerate internal services.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-72784 https://cve.radiocsirt.org/vuln/ghsa-hvvw-h49x-4xmw <p>Craft CMS versions &gt;= 5.0.0-RC1 before 5.10.6 and &gt;= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save&lt;Volume&gt;Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp() does not cover CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, and the only IP check runs after the request has already been issued. An attacker holding a GraphQL token scoped only to asset-creation permissions can disclose internal HTTP content from CGNAT/NAT64 targets, force outbound GET requests to internal hosts (including RFC1918, loopback, and metadata endpoints), and enumerate internal services.</p> <p>Craft CMS versions &gt;= 5.0.0-RC1 before 5.10.6 and &gt;= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save&lt;Volume&gt;Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp() does not cover CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, and the only IP check runs after the request has already been issued. An attacker holding a GraphQL token scoped only to asset-creation permissions can disclose internal HTTP content from CGNAT/NAT64 targets, force outbound GET requests to internal hosts (including RFC1918, loopback, and metadata endpoints), and enumerate internal services.</p> https://cve.radiocsirt.org/vuln/ghsa-hvvw-h49x-4xmw