NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add_url endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter priv…
CVSS 4.0MEDIUM 6.3·Network·Low privileges·No interaction·EPSS 0.00351·Published 2026-06-25·Fixed in 14.5.0CWE-918
NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary user_id values to the GET /social/interactions endpoint with…
CVSS 4.0MEDIUM 5.3·Network·Low privileges·No interaction·EPSS 0.00331·Published 2026-06-25·Fixed in 14.5.0CWE-639