Approved changes feed: RSS · Atom
cpe:2.3:a:samuelclay:newsblur:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Samuelclay (feea6c3d-176c-50b2-b605-1d3095a2f2bb) |
|---|---|
| Product | Newsblur (c43ebe3d-fb8f-5d18-a1a6-37603e000bc9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-56772 |
vulnerable | 2026-07-29 01:00:29.292573 |
NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint
MEDIUM (4.3)
NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary user_id values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate user_id values to access another user's follows, replies, and social activity without authorization.
Published: 2026-06-25T18:08:13.908Z
Updated: 2026-11-08T14:06:19.824Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-56771 |
vulnerable | 2026-07-29 01:00:29.292265 |
NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint
HIGH (8.5)
NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add_url endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and cloud metadata endpoints, enabling internal network scanning and sensitive data exfiltration.
Published: 2026-06-25T18:07:31.771Z
Updated: 2026-11-08T14:06:19.102Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.