Advisories · Technology

s9y Serendipity.

Every CVE that names s9y Serendipity among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-73629 CVE record

CVSS 8.4 High

Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses
- s9y Serendipity
- Server-side request forgery (SSRF)
Not analysed yet 13 Aug 2026
CVE-2026-73628 CVE record

CVSS 5.3 Medium

Serendipity 2.3.5 Reflected XSS via search clean-URL route
- s9y Serendipity
- Cross-site scripting (XSS)
Not analysed yet 13 Aug 2026
CVE-2026-67350 CVE record

CVSS 2.1 Low

Serendipity < 2.6.1 Open Redirect via exit.php
- s9y Serendipity
- Open redirect
Not analysed yet 31 Jul 2026
CVE-2026-67351 CVE record

CVSS 8.7 High

Serendipity < 2.6.1 Authentication Bypass via Username Collision
- s9y Serendipity
- Authentication bypass
Not analysed yet 30 Jul 2026
CVE-2023-53933 CVE record

CVSS 8.7 High

Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload
- s9y Serendipity
- Unrestricted file upload
Not analysed yet 17 Dec 2025
CVE-2023-53932 CVE record

CVSS 5.1 Medium

Serendipity 2.4.0 Stored Cross-Site Scripting via Admin Entry Creation
- s9y Serendipity
- Cross-site scripting (XSS)
Not analysed yet 17 Dec 2025