CVE-2026-94621Published
AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction
Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-94621 · Microsoft / collected KEV context
cve-program · CVE-2026-94621
- https://github.com/aliasvault/aliasvault/security/advisories/GHSA-7hm6-fj4m-pf6f
- https://github.com/aliasvault/aliasvault/pull/2311
- https://github.com/aliasvault/aliasvault/commit/7eb4fee71f4582cfc80b8daea421b99d6aa9f814
- https://github.com/aliasvault/aliasvault/commit/90ea7d6bb4c74ca169ee1dde3ca38b08bd0966ed
- https://github.com/aliasvault/aliasvault/releases/tag/0.30.3
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.