CVE-2026-33953HIGH 8.5EPSS p19.0%

CVE-2026-33953CVE-2026-33953

Description

LinkAce is a self-hosted archive to collect website links. Versions prior to 2.5.3 block direct requests to private IP literals, but still performs server-side requests to internal-only resources when those resources are referenced through an internal hostname. This allows an authenticated user to trigger server-side requests to internal services reachable by the LinkAce server but not directly reachable by an external user. Version 2.5.3 patches the issue.

Scoring

CVSS 3.18.5 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
EPSS0.27% probability of exploitation · percentile 19.0% · 2026-06-18T12:00:27Z
Published2026-03-27
Last modified2026-03-31

Underlying weaknesses· 1

CWE-918

References

  1. https://github.com/Kovah/LinkAce/security/advisories/GHSA-wp4g-qw9j-wfjg

1

TypeTargetConfidenceTier
WeaknessServer-Side Request Forgery (SSRF)cwe-9180%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-40905
CVE
CVE-2026-45344
CVE
CVE-2026-23899
CVE
CVE-2026-44313
CVE
CVE-2025-21332
CVE
CVE-2025-59334
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.