CVE-2026-72606

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get() without host or IP validation, and ALLOW_NEW_REGISTRATIONS defaults to true enabling anonymous triggering. An attacker can reach internal services or cloud metadata endpoints from the server.

• CWE-918

• https://github.com/pinry/pinry

Published

Aug 11, 2026

Last Modified

Aug 11, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72600A broken access control vulnerability in Idurar IDURAR ERP C…7.5
• CVE-2026-72601A broken access control vulnerability in CSZ CMS 1.3.2 allow…7.5
• CVE-2026-72602A path traversal vulnerability in AsyncFuncAI deepwiki-open …7.5
• CVE-2026-72603An OS command injection vulnerability in wg-easy 15.3.0 allo…9.9
• CVE-2026-72604A path traversal vulnerability in Intelliants Subrion CMS th…6.5
• CVE-2026-72605A missing authentication vulnerability in Swing Music 3.0.0 …7.5
• CVE-2026-72607A stored SQL injection vulnerability in Koha through 24.11.1…7.1
• CVE-2026-72608A stored SQL injection vulnerability in Koha through 24.11.1…6.5
• CVE-2026-72609An SQL injection vulnerability in Koha through 24.11.17, 25.…7.1
• CVE-2026-7261In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.…9.8
• CVE-2026-72610A stored SQL injection vulnerability in Koha through 24.11.1…4.3
• CVE-2026-7262In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.…7.5