CVE-2026-31955 — Versions Prior To Server-Side Request Forgery

/MEDIUM /CVSS 4.9/10
Written by SCW Vulnerability Desk Vulnerability Intelligence
National Vulnerability Database vulnerabilitycvemedium-severityserver-side-request-forgerycwe-918
CVE-2026-31955 — Versions Prior To Server-Side Request Forgery

CVE-2026-31955 — Xibo is an open source digital signage platform with a web content management system and Windows display player software. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 4.4.1 allows users with DataSet permissions to make arbitrary HTTP request

What This Means For You

  • If your environment is affected by CWE-918, review your exposure and prioritize patching based on your environment. Monitor vendor advisories for CVE-2026-31955 updates and patches.
🛡️ Am I exposed to this? Get detection rules for CVE-2026-31955 — Splunk, Sentinel, Elastic, QRadar & more →

Related ATT&CK Techniques

T1190 Exploit Public-Facing Application Initial Access T1571 Non-Standard Port Discovery T1071.001 Web Protocols Command and Control

🛡️ Detection Rules

3 rules · 6 SIEM formats

3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.

high T1190 Initial Access

CVE-2026-31955 - Xibo SSRF via DataSet Creation

Sigma YAML — free preview
✓ Sigma · Splunk SPL Sentinel KQL Elastic QRadar AQL Wazuh Get rules for your SIEM →

Indicators of Compromise

IDTypeIndicator
CVE-2026-31955 vulnerability CVE-2026-31955
CWE-918 weakness CWE-918

Written by SCW Vulnerability Desk

Source & Attribution
Source PlatformNVD
ChannelNational Vulnerability Database
PublishedApril 24, 2026 at 04:16 UTC

This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.

Believe this infringes your rights? Submit a takedown request.

Related Posts

Ruby ERB Deserialization Flaw Allows Code Execution

CVE-2026-41316 — ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in...

vulnerabilityCVEhigh-severitycode-executioncwe-693
/SCW Vulnerability Desk /HIGH /8.1 /⚑ 4 IOCs /⚙ 3 Sigma

OSSN Resource Exhaustion: DoS Risk from Malicious Image Uploads

CVE-2026-41309 — Open Source Social Network (OSSN) is open-source social networking software developed in PHP. Versions prior to 9.0 are vulnerable to resource exhaustion. An...

vulnerabilityCVEhigh-severitydenial-of-servicecwe-400cwe-770
/SCW Vulnerability Desk /HIGH /8.2 /⚑ 2 IOCs /⚙ 3 Sigma

CVE-2026-41305 — Cross-Site Scripting (XSS)

CVE-2026-41305 — PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax...

vulnerabilityCVEmedium-severitycross-site-scripting-xsscwe-79
/SCW Vulnerability Desk /MEDIUM /6.1 /⚑ 2 IOCs /⚙ 2 Sigma