https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-03T08:14:53.489645+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-73629 fkie_cve-2026-73629 2026-10-03T08:14:53.491499+00:00

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.

 https://db.gcve.eu/vuln/ghsa-fh9h-cxrw-2xj2 GHSA-fh9h-cxrw-2xj2 2026-10-03T08:14:53.491575+00:00

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.