Live › vulnerability › CVE-2026-107046
FocusPodcast version code 70 has a server-side request forgery flaw in the url, title, author and coverUrl handling. An attacker who supplies a crafted URL can make the app request internal resources and probe them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 17:26 UTC. All times on this page are UTC.
Only installs of FocusPodcast version code 70 are named in the source; the source does not say which configuration or feed path is needed. unknown
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL.
This page as .md · .json · in your agent: get_signal("CVE-2026-107046")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.