Medium severity · published Oct 28, 2026
CVE-2026-118586
dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery
New
5.3
CVSS
–
EPSS
No
On KEV
Description
A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FE
feedfinder2 · dfm
0.0.1; 0.0.2; 0.0.3; 0.0.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118586
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118586
vdb-entry
https://vuldb.com/vuln/428026
signature
https://vuldb.com/vuln/428026/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-118586
third-party-advisory
https://vuldb.com/submit/1026092
issue-tracking
https://github.com/dfm/feedfinder2/issues/16
product
https://github.com/dfm/feedfinder2/