medium · CVSS v3 5.4 · CVSS v4 5.3

CVE-2026-125367

Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users…

Description

Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.

Scores

Severity
medium
CVSS v2
5.5
CVSS v3
5.4
CVSS v4
5.3
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-125375

MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sort_data. Attackers owning any project can reparent and reorder documents by sequential ID and set their status to draft or removed, hiding published documents.

View analysis

medium

CVE-2026-117477

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL.

View analysis

medium

CVE-2026-125077

A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

View analysis

medium

CVE-2026-125357

Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle_request that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../ to bypass the '/../' substring check and read munin.conf and plugin-conf.d files containing monitored service credentials.

View analysis