{"metadata": {"vulnerability": "CVE-2026-71495", "count": 11, "kinds": {"milestone": 3, "sighting": 5, "kev": 0, "other": 3}}, "data": [{"timestamp": "2026-08-06T19:56:23.725Z", "date_only": false, "value": "2026-08-06T19:56:23.725Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-71495", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-06T18:05:05.676Z", "date_only": false, "value": "2026-11-06T18:05:05.676Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-71495", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-06T18:05:05.676Z", "date_only": false, "value": "2026-11-06T18:05:05.676Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-71495", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-06T18:05:05.676Z", "date_only": false, "value": "2026-11-06T18:05:05.676Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-71495", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-06T18:20:31.410Z", "date_only": false, "value": "2026-11-06T18:20:31.410016Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117570878229975883", "record": "CVE-2026-71495", "field": "creation_timestamp", "uuid": "b6a31cda-ee29-457a-b718-966e4429ca86", "content": "CVE-2026-71495 Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service. This issue is fixed in version 0.20.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-71495https://github.com/open-wanderer/wanderer/security/advisories/GHSA-7vqq-mjjr-h9j5https://github.com/open-wanderer/wanderer/pull/1104https://github.com/open-wanderer/wanderer/commit/c371337b3db1d2895b5cad651046ef0ad4dfc802https://github.com/open-wanderer/wanderer/releases/tag/v0.20.0#open-wanderer #wanderer#CVE_2026_71495#bot", "url": "https://infosec.exchange/users/cve/statuses/117570878229975883"}, {"timestamp": "2026-11-06T19:17:56.657Z", "date_only": false, "value": "2026-11-06T19:17:56.657", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-71495", "record": "FKIE_CVE-2026-71495", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-06T19:17:56.657Z", "date_only": false, "value": "2026-11-06T19:17:56.657", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-71495", "record": "FKIE_CVE-2026-71495", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-06T19:31:03.668Z", "date_only": false, "value": "2026-11-06T19:31:03.668557Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzo4nk5dpm2t", "record": "CVE-2026-71495", "field": "creation_timestamp", "uuid": "f7e53dc1-0d67-423a-aeb3-9ce1cb8fb9ff", "content": "\ud83d\udd34 CVE-2026-71495 - Critical (10)\n\nWanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-71495/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzo4nk5dpm2t"}, {"timestamp": "2026-11-06T19:31:04.913Z", "date_only": false, "value": "2026-11-06T19:31:04.913971Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzo4nkmqihhq", "record": "CVE-2026-71495", "field": "creation_timestamp", "uuid": "496dc7e2-8d30-46f9-9368-0f051926ad10", "content": "CVE Radar | CVE-2026-71495 | CVSS 10.0\n\nWanderer Unauthenticated Server-Side Request Forgery\n\nWanderer versions before 0.20.0 contain an unauthenticated server-side request forgery issue in the trail download endpoint when\u2026\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1390", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzo4nkmqihhq"}, {"timestamp": "2026-11-06T20:07:34.962Z", "date_only": false, "value": "2026-11-06T20:07:34.962870Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzo6ov6ozd2u", "record": "CVE-2026-71495", "field": "creation_timestamp", "uuid": "d4e82333-f6aa-4055-addd-bc97cb4e7ea4", "content": "\ud83d\udea8 CVE-2026-71495 \u2014 CVSS 10 CRITICAL\n\nWanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PR...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-71495\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzo6ov6ozd2u"}, {"timestamp": "2026-11-07T01:10:02.949Z", "date_only": false, "value": "2026-11-07T01:10:02.949164Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzoplqazof2v", "record": "CVE-2026-71495", "field": "creation_timestamp", "uuid": "de5f6fa6-14c0-4647-8713-02b311d5d216", "content": "CVE-2026-71495\nThe Wanderer trail\u2011sharing system lets anyone send a request to internal network addresses when the PUBLIC_PRIVATE_INSTANCE setting is false, exposing data and letting attackers map or disrupt your internal\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzoplqazof2v"}], "metrics": {"as_of": "2026-11-08T03:24:43.835Z", "anchors": {"origin": {"timestamp": "2026-11-06T18:05:05.676Z", "date_only": false, "value": "2026-11-06T18:05:05.676Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-71495", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-06T18:05:05.676Z", "date_only": false, "value": "2026-11-06T18:05:05.676Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-71495", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 119978.159107, "hours": 33.32726641861111, "days": 1.388636100775463, "min_seconds": 119978.159107, "max_seconds": 119978.159107, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-06T18:05:05.676Z", "date_only": false, "value": "2026-11-06T18:05:05.676Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-71495", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T03:24:43.835Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}