Posted by Shuxin Pan on Oct 13 Severity: moderate Affected versions: - Apache Fesod (Incubating) 2.0.2-incubating Description: Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's resolved IP addresses and then opens a...
CVE-2026-107460: Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/141
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Post-Quantum Cryptography Part 2: 2030 Is Not the Deadline
Post-Quantum Cryptography Part 2: 2030 Is Not the Deadline November 5, 2026 Timothy Amerson BLOG 5 min. TL;DR – GAO’s latest report shows why waiting for the compliance…
The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603
Executive summary In 2025, several threat actors exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve…
A Hybrid Approach for Automated Security Pattern Recovery
arXiv:2611.05823v1 Announce Type: new Abstract: Security-by-design emphasises integrating security into software design and development. Security pattern catalogues…
PIMROP: A Feasibility Study of Return-Oriented Programming on Commercial Processing-in-Memory Architectures
arXiv:2611.06036v1 Announce Type: new Abstract: Processing-in-Memory places small programmable cores on the memory device, where they execute beside the DRAM banks and…
Towards Early Warning of Real-World Vulnerabilities: An Evidence-Aware Decoupled Method for CVSS Vector Prediction Based on Unstructured Disclosures
arXiv:2611.06477v1 Announce Type: new Abstract: Early assessment of Common Vulnerability Scoring System (CVSS) vectors from Open Source Intelligence (OSINT) can reduce…
CVE-2026-109518: RCE in apt(1) (DSA 6607-1)
Posted by Jan Schaumann on Nov 04 This Debian Security Advisory for CVE-2026-109518 in apt(1) seems worth sharing more widely…