Server-side request forgery (SSRF) via unvalidated RSS feed URLs

PKSA-55tn-sgd6-9twh CVE-2026-57232

Affected version: >=5.3.35,<5.3.48|>=5.4.0,<5.7.9

Reported by:
FriendsOfPHP/security-advisories

Credentials disclosure in the crawler

PKSA-8pr1-zw9p-tzyx CVE-2026-55824

Affected version: >=4.13.0,<5.3.47|>=5.4.0,<5.7.7

Reported by:
FriendsOfPHP/security-advisories