Live › vulnerability › CVE-2026-118586
Go to dashboardfeedfinder2 up to version 0.0.4 has a flaw in its find_feeds function in feedfinder2.py that allows server-side request forgery. A remote attacker who supplies crafted input can make the server issue requests to destinations of the attacker's choosing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 00:36 UTC. All times on this page are UTC.
Applications that call feedfinder2's find_feeds on URLs or content that an outside party can influence are exposed, because the flaw lets that input steer server-side requests. Services that only run feedfinder2 on trusted, hard-coded inputs are much less exposed. unknown whether any particular deployment setting changes the exposure.
No product ranges from the sources yet.
pip show feedfinder2 and look for anything at or below 0.0.4feedfinder2 to see whether it is pinned or pulled in indirectlyEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-118586")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.