PULSE
EN VIVO28señales / 24h
EN
FEED
ransomgunra reclama a worldtube · KR · Technologyransomqilin reclama a WD Masonry & Concrete · US · Otherransomakira reclama a University SprinklerSystems · Manufacturingransomorova reclama a Tat Fung Textile Co., Ltd. · HK · Manufacturingransomorova reclama a Integrated Site Management · US · Professional Servicesransomorova reclama a Conceptual Designs, Inc. · US · Otherransomorova reclama a JK Capital Management Limited · HK · Financial Servicesransomorova reclama a Global Friction Products, Inc · US · Manufacturingransomaurora reclama a GILDE Handwerk Macrander GmbH & Co. KG · DE · Manufacturingransomaurora reclama a US Installation Group, Inc. · US · Manufacturingransomincransom reclama a pushidrosal.id · ID · Otherransomincransom reclama a lccgroup.com · PH · Professional Servicesransomincransom reclama a https://geleximco.vn/ · VN · Manufacturingransomincransom reclama a clintonhealthaccess.org · US · Healthcareransomgunra reclama a worldtube · KR · Technologyransomqilin reclama a WD Masonry & Concrete · US · Otherransomakira reclama a University SprinklerSystems · Manufacturingransomorova reclama a Tat Fung Textile Co., Ltd. · HK · Manufacturingransomorova reclama a Integrated Site Management · US · Professional Servicesransomorova reclama a Conceptual Designs, Inc. · US · Otherransomorova reclama a JK Capital Management Limited · HK · Financial Servicesransomorova reclama a Global Friction Products, Inc · US · Manufacturingransomaurora reclama a GILDE Handwerk Macrander GmbH & Co. KG · DE · Manufacturingransomaurora reclama a US Installation Group, Inc. · US · Manufacturingransomincransom reclama a pushidrosal.id · ID · Otherransomincransom reclama a lccgroup.com · PH · Professional Servicesransomincransom reclama a https://geleximco.vn/ · VN · Manufacturingransomincransom reclama a clintonhealthaccess.org · US · Healthcare
← Todos los CVEs
CVE Watch4 ago 2026

CVE-2026-14939

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, a

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 4 ago 2026 · Última mod.: 4 ago 2026

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.

Referencias oficiales
CVEs relacionados

Sin CVEs relacionados por CWE o producto.