https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-11T13:50:33.805746+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-107394 CVE-2026-107394 — Indico: Incomplete Server-Side Request Forgery (SSRF) check 2026-10-11T13:50:33.807205+00:00

Affected: indico

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features. This issue is fixed in version 3.3.13.