CVE-2026-44515

Nextcloud News is an RSS/Atom feed reader. Prior to 28.3.0-beta.1, Nextcloud News allows authenticated users to add feeds by providing a feed URL (via the web interface or the API). In affected versions, an authenticated attacker could provide a URL pointing to internal/private IP ranges or localhost, causing the Nextcloud server to perform server-side HTTP requests to attacker-controlled destinations, but not relaying the result. This enables blind SSRF, which can be used to scan or probe internal network services that are reachable from the Nextcloud server. This vulnerability is fixed in 28.3.0-beta.1.

• CWE-918

• https://github.com/nextcloud/news/security/advisories/GHSA-jcfr-rmj6-cpfj

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4451Insufficient validation of untrusted input in Navigation in …8.8
• CVE-2026-44510Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-44511Katalyst Koi is a framework for building Rails admin functio…7.4
• CVE-2026-44512Open Neural Network Exchange (ONNX) is an open standard for …5.5
• CVE-2026-44513Diffusers is the a library for pretrained diffusion models.…8.8
• CVE-2026-44514Kubetail is a real-time logging dashboard for Kubernetes. Pr…6.5
• CVE-2026-44516Valtimo is an open-source business process automation platfo…7.6
• CVE-2026-44518liboqs is a C-language cryptographic library that provides i…5.3
• CVE-2026-4452Integer overflow in ANGLE in Google Chrome on Windows prior …8.8
• CVE-2026-44520Docling-Graph turns documents into validated Pydantic object…5.7
• CVE-2026-44521elFinder is an open-source file manager for web, written in …8.8
• CVE-2026-44522Note Mark is an open-source note-taking application. From 0.…8.6