CVE-2026-46556

Description

FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

Overview

State

—

Assigner (CNA)

—

CVSS severity

medium

CVSS score

6.5 / 10

CVSS vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Effective score

6.5 / 10 MEDIUM source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-46556

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-46410

Assigner

GitHub_M

Published

Jul 21, 2026, 8:34:23 PM

Updated

Jul 22, 2026, 2:50:37 PM

EUVD base score (CVSS 3.1)

6.5 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EUVD-reported EPSS

0.2100

Vendors

flaskbb

Products

flaskbb (< 2.2.1)

Aliases

GHSA-xq32-9g7q-7297, PYSEC-2026-2479

ENISA description: FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery (SSRF) vulnerability in get_image_info() allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services. This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities. Version 2.2.1 patches the issue.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (2)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-46556 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-46556 tenable:www.cve.org

• Oracle Critical Patch Update, April 2026 Security Update Review
  web:blog.qualys.com

  Oracle released its second quarterly edition of this year's Critical Patch Update. The update received patches for 481 security vulnerabilities.

  2026-05-26 03:09 UTC
• Security Advisory Bulletin 064 | Ubiquiti Community
  web:community.ui.com

  Published: May 21, 2026 Updated: May 22, 2026 Version: 1.1 Revision: 1.1 Summary 1 of 5 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. Affected Products: UniFi OS Server (Version 5.0.6 and earlier) Mitigation : Update your UniFi OS Server to Version 5.0.8 or later ...

  2026-05-26 03:09 UTC
• Wireshark 4.6.6 Released With Fix for Dissector Crash via Malformed ...
  web:cybersecuritynews.com

  The Wireshark Foundation has released Wireshark 4.6.6, addressing a critical security vulnerability in the ROHC (Robust Header Compression) protocol dissector that could allow an attacker to crash the application by injecting a specially crafted, malformed packet.

  2026-05-26 03:09 UTC
• Security Advisories and Bulletins | Microsoft Learn
  web:learn.microsoft.com

  Learning path Learn how Microsoft supports secure software development as part of a cybersecurity solution - Training Secure software development means integrating security into each phase of your development lifecycle, from requirements analysis to maintenance. Microsoft provides many services that can help you develop more secure code and deploy a more secure application in the cloud. This ...

  2026-05-26 03:09 UTC
• Landing Page | ServiceNow Common Vulnerabilities & Exposures (CVE ...
  web:support.servicenow.com

  Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures ( CVEs ) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch , and hotfix release notes, which are available at https://docs.servicenow.com, for a complete list of ...

  2026-05-26 03:09 UTC
• IBM Support: Fix Central
  web:www.ibm.com

  IBM Support, Fix Central All code (including Machine Code updates, samples, fixes or other software downloads) provided on the Fix Central website is subject to the terms of the applicable license agreements. Machine Code updates for Power Systems and System Storage are available for IBM machines that are under warranty or an IBM hardware maintenance service agreement. Some exceptions apply ...

  2026-05-26 03:09 UTC
• Oracle Critical Patch Update Advisory - April 2026
  web:www.oracle.com

  This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

  2026-05-26 03:09 UTC
• Quantifying 2026 Routinely Targeted Vulnerabilities (So Far)
  web:www.vulncheck.com

  VulnCheck identified 25 CVEs disclosed in 2026 that have been routinely targeted by adversaries and researchers so far this year, drawing from a global body of exploit code and exploitation data.

  2026-05-26 03:09 UTC
• Windows 11 April 2026 Update tested: What's new, improved and fixed
  web:www.windowslatest.com

  Windows 11 April 2026 update adds Narrator Copilot support, faster Settings, File Explorer fixes, and key security improvements.

  2026-05-26 03:09 UTC
• Patch Tuesday May 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-05-26 03:09 UTC

Only Available for Registered Users. Sign in to view.