CVE-2026-92931CWE-918ssrf

CVE-2026-92931

High · published October 5, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-10-05T18:17Z
References (1)
https://community.progress.com/s/article/Sitefinity-Critical-Security-Advisory-for-Addressing-Security-Vulnerabilities-in-Next-js-September-2026 · [email protected]
EPSS history
Timeline
  • 07 OCT 03:43Z
    EPSS moved — → 0%
    epss
  • 05 OCT 13:06Z
    CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK
    cvelistv5