CVE-2026-55876 is a vulnerability in Helium, a free online student planner, that allows authenticated users to upload malicious SVG and HTML attachments. These attachments can execute embedded scripts when opened, potentially leading to phishing attacks. The issue is fixed in version 2.2.60. Helium is used by students for managing classes, homework, grades, and notes. The vulnerability affects the POST /p [truncated]
CVE-2026-55875 is a Server-Side Request Forgery (SSRF) vulnerability in HeliumEdu's platform, specifically in the external calendar URL feature. This vulnerability allows authenticated users to submit arbitrary URLs, which can lead to forced outbound requests and internal service reconnaissance. The issue arises from the validate_url function in helium/feed/services/icalexternalcalendarservice.py, which o [truncated]
