rootpwn

medium · CVSS v3 4.9 · CVSS v4 6.9

CVE-2026-92813

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing una…

Description

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to unauthenticated callers.

Scores

Severity
medium
CVSS v2
6.1
CVSS v3
4.9
CVSS v4
6.9
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-92526

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/leave/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.

View analysis

medium

CVE-2026-86340

CVE-2026-86340 exposes a flaw in the deployment gate logic of protected environments. High‑privileged users can delete the sole approver (user or group) and bypass the required multi‑party approval process, allowing unauthorized deployments.

View analysis

medium

CVE-2026-92413

A remote null‑pointer dereference flaw exists in Artifex MuPDF’s PDF Xref loading routine. The bug can crash the application when processing a crafted PDF, leading to a denial‑of‑service condition.

View analysis

medium

CVE-2026-86449

The LearnPress WordPress plugin (versions prior to 4.4.7) fails to verify user permissions when processing a REST API request that filters courses by status. This flaw lets an unauthenticated user retrieve a list of courses that are draft, pending, private, scheduled, or trashed, exposing unpublished content.

View analysis