eventschedule CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM eventschedule CVE published 2026-10-23

CVE-2026-55190

The Event Schedule platform is vulnerable to Server-Side Request Forgery (SSRF) due to a bypass in the isUrlSafe() function. This function, used to guard against SSRF, can be circumvented in two ways: via bracketed IPv6 literals and a fail-open condition in a v4-only resolver. These bypasses allow an attacker to reach internal or localhost services when importing events. The vulnerability exists in versio [truncated]