Loading story…
A public advisory disclosed CVE-2026-41461, a blind server-side request forgery flaw in SocialEngine affecting 7.8.0, 7.7.0, and likely earlier versions. The vulnerability stems from improper sanitization of the uri parameter in the /core/link/preview endpoint, allowing an authenticated remote attacker to make the SocialEngine server issue HTTP requests to internal or arbitrary destinations, including localhost-accessible services. The issue was discovered by Egidio Romano.
The vendor was notified in February 2026, but the flaw remained present in SocialEngine 7.8.0 and no official fix was available at the time of public disclosure after the 60-day window. SocialEngine later released version 8.0.0, and the researcher confirmed that release properly remediated the SSRF issue. The disclosure indicates the bug could be abused for internal network reachability and server-side request pivoting from authenticated accounts.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
On verification, Egidio Romano confirmed that SocialEngine 8.0.0 properly remediated the blind SSRF vulnerability tracked as CVE-2026-41461.
SocialEngine released version 8.0.0 following the public disclosure of the SSRF issue. This release was later confirmed by the reporter to address the vulnerability.
After the 60-day disclosure window, the SSRF issue was publicly disclosed, with no official patch or workaround available at that time. The advisory said authenticated attackers could force the server to send requests to internal or arbitrary destinations.
SocialEngine released version 7.8.0, but the blind SSRF vulnerability remained present. The flaw involved insufficient sanitization of the /core/link/preview endpoint's uri parameter.
Egidio Romano reported a blind server-side request forgery flaw in SocialEngine to the vendor. The issue affected version 7.7.0, likely earlier releases, and was later assigned CVE-2026-41461.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
karmainsecurity.com
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Angular disclosed a **server-side request forgery (SSRF)** issue in `@angular/platform-server` that affects applications using Server-Side Rendering. The flaw, tracked as `CVE-2026-41423`, stems from improper handling of protocol-relative and backslash-based URLs passed from server engines such as Express into Angular rendering functions. A crafted request can cause Angular to treat an attacker-controlled domain as the application's origin, allowing relative `HttpClient` requests and `PlatformLocation.hostname` references to resolve to external infrastructure. The issue can expose internal services, including private APIs and cloud metadata endpoints, and related advisory material also links the bug family to **header injection** risks in Angular SSR deployments. Angular fixed the vulnerability in versions `19.2.21`, `20.3.19`, `21.2.9`, and `22.0.0-next.8`, leaving earlier releases vulnerable where SSR is enabled and untrusted request paths can influence rendering context.
Jun 29, 2026
A vulnerability in Flarum tracked as **CVE-2023-40033** allows an authenticated user with a basic forum account to supply a malicious avatar URL and read arbitrary local files from the server. The issue stems from Flarum's handling of avatar retrieval and can be exploited as a blind file-content oracle, potentially exposing application configuration, credentials, and other sensitive filesystem data. The same flaw can be used for blind server-side request forgery (SSRF), enabling requests to internal or otherwise inaccessible network resources through the affected Flarum instance. Flarum fixed the issue in `flarum/framework` version **1.8.0** and later; organizations should upgrade affected deployments and review logs and configuration exposure for evidence of exploitation.
Sep 3, 2026
A high-severity server-side request forgery flaw tracked as **CVE-2026-54690** affects `datamodel-code-generator` when it processes attacker-controlled JSON Schema `$ref` values pointing to `http` or `https` URLs. In vulnerable releases, the tool silently resolves remote references during schema processing, allowing outbound requests to arbitrary destinations; one report places the affected range at **0.9.1 through 0.60.x**, while another indicates exposure through **0.61.0**. The issue has a **CVSS v3.1 score of 8.2** and is tied to schema resolution and HTTP fetch logic in files including `jsonschema.py` and `http.py`. Researchers said the vulnerable code passes untrusted URLs directly to the HTTP client, follows redirects, and does not adequately restrict hostnames, ports, or IP ranges, creating a path to reach internal services such as `127.0.0.1` and cloud metadata endpoints like `169.254.169.254`. Fetched content may also be incorporated into generated output, raising information disclosure risk in addition to SSRF. The issue is fixed in **version 0.61.0**, with the patch adding URL validation and blocking localhost-style and non-global IP targets unless private-network access is explicitly enabled; recommended mitigations include disabling remote reference resolution or blocking private-network access.
Jul 29, 2026