CVE-2026-100858 heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes

heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP requests to URLs taken from user-created credentials webhookurl / flaresolverrurl using an unguarded HTTP client, bypassing the SSRF egress guard that...

PT-2026-99478

Name of the Vulnerable Software and Affected Versions heym versions prior to 0.0.109 Description A server-side request forgery SSRF issue exists in the Slack, Discord, and Crawler workflow nodes. These nodes use an unguarded HTTP client to send requests to URLs provided in user-created credential...