https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-12T10:58:03.473042+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-125367 fkie_cve-2026-125367 2026-11-12T10:58:03.475150+00:00

Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.

 https://db.gcve.eu/vuln/ghsa-w9q5-ph3c-c66x GHSA-w9q5-ph3c-c66x 2026-11-12T10:58:03.475387+00:00

Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.