200 matches found
DingQz Docker-Proxy authorization issue vulnerability
Versions 5.1.9 and earlier of DingQz Docker-Proxy contain an authorization issue vulnerability. This flaw stems from a lack of authentication in hubcmdui routes/config.js. Unauthenticated attackers can read and modify configurations via /api/config, thereby obtaining the WeChat webhook URL and...
CVE-2026-114080 Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert channels pointing to loopback, internal, or cloud metadata...
CVE-2026-114080 Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert channels pointing to loopback, internal, or cloud metadata...
CVE-2026-114080 Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert channels pointing to loopback, internal, or cloud metadata...
CVE-2026-114080
Trigger.dev versions prior to 4.5.2 are vulnerable to a blind server-side request forgery (SSRF) flaw. The root cause is the application's failure to validate alert-channel webhook URLs , which allows authenticated project members to force the server to send requests to arbitrary locations. An at...
CVE-2026-114076 Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud...
CVE-2026-114076
Versions of Trigger.dev prior to 4.5.2 are vulnerable to a blind server-side request forgery (SSRF) vulnerability. The root cause is the use of an unvalidated webhook alert channel URL , which allows authenticated tenants to force the webapp server to send POST requests to internal hosts. Exploit...
CVE-2026-114076 Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud...
CVE-2026-90821
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...
CVE-2026-90821 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...
CVE-2026-90821 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...
CVE-2026-90821 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...
CVE-2026-90821
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...
EUVD-2026-102872
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...
CVE-2026-90821
The Crafty Controller application contains an input neutralization vulnerability (CWE-79) within its Webhook URL form field component. A remote, authenticated attacker can exploit this flaw to perform stored XSS by providing malicious input through the form. No specific patch versions, workaround...
CVE-2026-90821: Improper Neutralization of Input During Web Page Generation
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...
PT-2026-115611
Name of the Vulnerable Software and Affected Versions Crafty Controller affected versions not specified Description An input neutralization issue in the Webhook URL form field component allows a remote, authenticated attacker to execute stored Cross-Site Scripting XSS by providing malicious input...
Arcadia Technology Crafty Controller Cross-site Scripting Vulnerability
The Arcadia Technology Crafty Controller versions from 4.2.0 to 4.11.0 have a cross-site scripting vulnerability. This vulnerability stems from improper handling of the Webhook URL form field component inputs. It may allow remotely authenticated attackers to execute stored-xss attacks through...
Mattermost information leakage vulnerability
Mattermost versions 11.10.0 and earlier of 11.10.x series, 11.7.9 and earlier of 11.7.x series, 11.9.1 and earlier of 11.9.x series, and 11.8.5 and earlier of 11.8.x series have a vulnerability involving information leakage. This vulnerability arises from failing to extract the operation...