CVE-2026-56227 Capgo - Server-Side Request Forgery via Webhook URL Validation

Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization admins can configure webhooks pointing to localhost or 127.0.0.1, and when triggered, the backend performs outbound requests to these...

CVE-2026-56227

Capgo before 12.128.2 is affected by a server-side request forgery (SSRF) in webhook URL validation. The flaw permits configuring webhooks to loopback or internal addresses (e.g., localhost/127.0.0.1). When triggered, the backend makes outbound requests to those addresses, and error responses are...

CVE-2026-56227

Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization admins can configure webhooks pointing to localhost or 127.0.0.1, and when triggered, the backend performs outbound requests to these...

CVE-2026-48909

creationtimestamp| type| source ---|---|--- 2026-06-20 13:49:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mopyrpawac2a 2026-06-21 03:00:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3morex5l44o2t 2026-06-21 03:00:34+00:00| seen|...

CVE-2026-48939

creationtimestamp| type| source ---|---|--- 2026-06-20 13:44:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mopyiqfnx42t 2026-06-21 01:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mor7wauvu62f 2026-06-21 01:30:29+00:00| seen|...

CVE-2024-20432

creationtimestamp| type| source ---|---|--- 2026-06-20 07:37:05+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mopdwwxbcz23 2026-07-26 07:01:47+00:00| seen| https://t.me/zhatez/1487 2026-07-27 00:01:31+00:00| seen| https://t.me/zhatez/1487 2026-07-28 23:00:03+00:00| seen|...

CVE-2026-56215

creationtimestamp| type| source ---|---|--- 2026-06-20 02:09:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moormx6w6z2g...

CVE-2006-7182

creationtimestamp| type| source ---|---|--- 2026-06-20 02:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3moorivoomi2g...

CVE-2026-53532

creationtimestamp| type| source ---|---|--- 2026-06-20 02:01:08+00:00| seen| https://bsky.app/profile/slackers.it/post/3moor6754ks2n...

CVE-2026-56214

creationtimestamp| type| source ---|---|--- 2026-06-20 01:59:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moor32cshz2e...

Linux Distros Unpatched Vulnerability : CVE-2026-40510

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in pivprocesshistory in src/libopensc/card-piv.c that allows...

PT-2026-51158

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2 Description An open redirect issue exists in the 'stripe portal' and 'stripe checkout' endpoints. These endpoints accept unvalidated callbackUrl, successUrl, and cancelUrl parameters. Authenticated attackers ca...

PT-2026-51174

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 27.1 Description Authenticated administrators can perform server-side request forgery SSRF—a flaw where a server is tricked into making requests to an unintended location—via the 'plugin/Live/test.php' endpoint. The...

CVE-2026-56330: URL Redirection to Untrusted Site

Capgo before 12.128.2 contains an open redirect vulnerability in stripeportal and stripecheckout endpoints that accept unvalidated callbackUrl, successUrl, and cancelUrl parameters. Authenticated attackers can craft malicious billing URLs to redirect users to attacker-controlled domains for...

CVE-2026-56227: Server-Side Request Forgery (SSRF)

Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization admins can configure webhooks pointing to localhost or 127.0.0.1, and when triggered, the backend performs outbound requests to these...

CVE-2026-56073

creationtimestamp| type| source ---|---|--- 2026-06-19 23:14:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moohtqinc627 2026-06-20 03:00:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116780199172553168 2026-06-20 03:00:28+00:00| seen|...

GHSA-G2GW-Q38M-VJFC Lokka: Azure Resource Manager URL path validation issue

Lokka versions prior to 2.1.2 constructed Azure Resource Manager request URLs using direct string concatenation with user-controlled path input. Specially crafted path values could alter URL authority parsing and cause Azure Resource Manager bearer tokens to be sent to an unintended host. Version...

CVE-2026-49295

creationtimestamp| type| source ---|---|--- 2026-06-19 21:58:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moodmsmybf2i...

CVE-2026-49346

creationtimestamp| type| source ---|---|--- 2026-06-19 21:55:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moodgnj5j42g...

CVE-2026-48773

creationtimestamp| type| source ---|---|--- 2026-06-19 21:49:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mood3toclx2h 2026-06-20 06:00:24+00:00| seen| https://infosec.exchange/users/offseq/statuses/116780906773492544 2026-06-20 06:00:25+00:00| seen|...