CVE-2026-62282

MEDIUM 6.5

OpenCVE: Server-Side Request Forgery (SSRF) in notifications

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests to hosts reachable from the OpenCVE server, including internal network resources, localhost interfaces, link-local addresses, and cloud metadata services, and retrieve information from reachable HTTP services. This issue is fixed in version 3.0.0.

CWE	CWE-918
Vendor	opencve
Product	opencve
Published	Sep 18, 2026

Stay Ahead of the Next One

Get instant alerts for opencve opencve

Be the first to know when new medium vulnerabilities affecting opencve opencve are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

opencve / opencve

< 3.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/opencve/opencve/security/advisories/GHSA-ch3g-4xvr-674q github.com: https://github.com/opencve/opencve/issues/743 github.com: https://github.com/opencve/opencve/pull/747 github.com: https://github.com/opencve/opencve/commit/0af7f894debc95c67fa53e7ba5a6cdecb10c34f0 github.com: https://github.com/opencve/opencve/releases/tag/v3.0.0