CVE-2026-125359
Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner
CVSS
4.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-918
Not enough EPSS history yet.
Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via savePanSouBaseUrlAction without role checks. Attackers can trigger probePanSou() to send server-side POST requests to internal hosts and use distinct error responses as an oracle for internal host and port discovery.
- github.comhttps://github.com/fancydirty/mediary-scout
- github.comhttps://github.com/fancydirty/mediary-scout/blob/v2026.10.29/apps/web/lib/pansou-probe.ts#L18-L34
- github.comhttps://github.com/fancydirty/mediary-scout/commit/9cb9ab5eea492bc8f61f5c4d63f9c6b6800f7e1f
- github.comhttps://github.com/fancydirty/mediary-scout/issues/366
- github.comhttps://github.com/fancydirty/mediary-scout/releases/tag/v2026.11.05
- www.vulncheck.comhttps://www.vulncheck.com/advisories/mediary-scout-before-2026.11.05-ssrf-via-pansou-search-source-setting
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-129648.0 HIG—
———A vulnerability allowing for privileged escalation of the viewer account to gain administrator privileges.6hCVE-2026-891295.8 MED—
———Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an unauthenticated attacker could craft a SOAP request that causes the server to return a SOAP fault to a URL under the attacker�s control. Successful exploitation could allow the attacker to disclose information about connected systems, impacting confidentiality, while integrity and availability remain unaffected.11hCVE-2026-1098116.5 MED—
———An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform (Application Server ABAP) has SSRF vulnerability due to insecure default settings. An authenticated attacker with low privileges could trick the victim to interact with a malicious server which allows the attacker to access sensitive information belonging to the victim and modify limited non-sensitive information. This results in a high impact on confidentiality and low impact on integrity. Availability is not impacted.11hCVE-2026-1253675.4 MED—
———Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.12hCVE-2026-1253665.4 MED—
———Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /add_feed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch without validation, using reflected error messages to probe internal hosts and ports.12hCVE-2026-1253635.4 MED—
———MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including the viewer role, to target internal addresses through notification channels. Attackers can set webhook or mail destinations to loopback, LAN or link-local addresses and call POST /api/notify-channels/{id}/test to probe the internal network.12h