Threats tagged 'ghsa-w9q5-ph3c-c66x'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	5.3	CVE-2026-125367Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up Medium5.32026-11-10GCVE DatabaseCVE-2026-125367 Pico versions through 4.1.2 have a server-side request forgery (SSRF) vulnerability in the feeds service. This flaw allows signed-up users to cause the server to fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL, potentially accessing loopback, RFC1918 private network, and cloud metadata endpoints. Report on CVE-2026-125367 Vulnerability CWE-918 #ghsa-w9q5-ph3c-c66x	GCVE Database	2026-11-10

Page 1 of 1