NVD HIGH: CVE-2026-100391 — MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerabili...

Friday, September 25, 2026 at 09:17 PM UTC·Source: NIST NVD

Updated: Saturday, September 26, 2026 at 01:00 AM UTC

Executive Summary

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full responses from the proxy server.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-100391

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Sep 25, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Alleged ShinyHunters Leader Arrested in Jordan

Known as Rey, the suspect is reportedly helping the FBI identify and locate other members of the extortion group. The post Alleged ShinyHunters Leader Arrested in Jordan appeared first on SecurityWeek .

1h agoSecurityWeek

LOWVulnerability

Community finance and open banking technology can support ‘credit invisibles’ – Salad Finance

People with low credit, whether due to a missed payment or a period of financial insecurity, are often disproportionately punished by the financial system by not being given loans, credit cards, and other forms of consumer credit.

1h agoFinextra

MEDIUMVulnerability

Slate Valley Unified School District voted not to pay ransom demand; Kairos likely to leak data

The Slate Valley Unified School District in Fair Haven, Vermont, has been responding to a security incident since September 3. On October 2, Kairos threat actors contacted DataBreaches to alert us to the incident and their response to the district’s claim that they believed student data had not been compromised. They were also angry that... Source

13h agoDataBreaches.net