{"vulnerability": "cve-2026-16223", "sightings": [{"uuid": "5f4a4fcb-3ccd-49b0-8fca-0467c1bcdeec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-16223", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116945821784754940", "content": "CVE-2026-16223: SSRF in 1Panel-dev CordysCRM 1.4.0 & 1.4.1 (MEDIUM, CVSS 5.3). Exploitable via appSecret \u2014 enables unauthorized server requests. No patch yet: restrict endpoint, monitor logs. https://radar.offseq.com/threat/cve-2026-16223-server-side-request-forgery-in-1panel-dev-cordyscrm-b282fef55db79c7d #OffSeq #SSRF #CyberSecurity #Vuln", "creation_timestamp": "2026-07-19T09:00:27.229103Z"}, {"uuid": "aac776f2-b8da-4a0c-aae4-8912c170b777", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-16223", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mqyg4qahpk2n", "content": "1Panel-dev CordysCRM v1.4.0 & 1.4.1 affected by CVE-2026-16223 (MEDIUM): SSRF via appSecret parameter. No patch \u2014 restrict exposure, monitor traffic. Details: https://radar.offseq.com/threat/cve-2026-16223-server-side-request-forgery-in-1panel-dev-cordyscrm-b282fef55db79c7d #OffSeq #SSRF #Vuln", "creation_timestamp": "2026-07-19T09:00:29.552002Z"}]}