Medium severity6.5NVD Advisory· Published Sep 18, 2026· Updated Sep 23, 2026
CVE-2026-62282
CVE-2026-62282
Description
OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests to hosts reachable from the OpenCVE server, including internal network resources, localhost interfaces, link-local addresses, and cloud metadata services, and retrieve information from reachable HTTP services. This issue is fixed in version 3.0.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
opencvePyPI | < 3.0.0 | 3.0.0 |
Affected products
1Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-ch3g-4xvr-674qghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-62282ghsaADVISORY
- github.com/opencve/opencve/commit/0af7f894debc95c67fa53e7ba5a6cdecb10c34f0nvdWEB
- github.com/opencve/opencve/issues/743nvdWEB
- github.com/opencve/opencve/pull/747nvdWEB
- github.com/opencve/opencve/releases/tag/v3.0.0nvdWEB
- github.com/opencve/opencve/security/advisories/GHSA-ch3g-4xvr-674qnvdWEB
News mentions
0No linked articles in our index yet.