s9y/serendipity Security Advisories | GitStock

high2026-04-14

Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header

GHSA-458g-q4fh-mj6r · CVE-2026-39971

medium2026-04-14

Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php

GHSA-4m6c-649p-f6gf · CVE-2026-39963