CVE-2026-76838

Hi.Events (an open-source event management platform) is affected by a Server-Side Request Forgery (SSRF) vulnerability in its webhook handling. The NoInternalUrlRule validates a webhook destination using gethostbyname() only at registration time , but the WebhookDispatchService never revalidates ...

The vulnerability of the _validate_webhook_url() function in the mlflow/utils/validation.py file of the machine learning lifecycle management platform allows a attacker to perform an SSRF attack and gain unauthorized access to protected information.

The vulnerability of the validatewebhookurl function in the mlflow/utils/validation.py file of the machine learning lifecycle management platform is related to insufficient validation of server-side requests. Exploiting this vulnerability could allow an attacker to perform an SSRF attack and gain...

cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests...

Missing Authentication for Critical Function

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the monitor endpoint, which does not validate incomi...

GO-2026-6155 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule...

CVE-2026-51583

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...

CVE-2026-51583

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...

CVE-2026-51583

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...

EUVD-2026-55637

The webhook URL validator in website/notifications/webhooks.py uses ip.isglobal to reject non-public addresses after DNS resolution. IPv6 transition addresses NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32 are classified as globally routable by IANA, so isglobal returns True even when...

CVE-2026-71271

Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does...

EUVD-2026-53356

Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does. Becau...

CVE-2026-71271

The CVE affects Memos server webhook URL validation. The isReservedIP() check validates candidate IPs against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified(), unlike isInternalIP() which does. Linux redirects connections to 0.0.0.0 to loopback (127.0.0.1). An attacker...

CVE-2026-71271 Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass

Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does...

CVE-2026-71271

Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does...

CVE-2026-71250

Firefly III is reported vulnerable due to IsValidWebhookUrl.php: the validator explicitly allows any address in 127.0.0.0/8, enabling an authenticated user with webhooks enabled to configure a webhook targeting loopback services on the server. Furthermore, the validator resolves the target once v...

CVE-2026-71250 Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding

Firefly III's webhook URL validator IsValidWebhookUrl.php filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user with webhooks enabled, which is off by default to configure a webhook targeti...

CVE-2026-71250 Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding

Firefly III's webhook URL validator IsValidWebhookUrl.php filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user with webhooks enabled, which is off by default to configure a webhook targeti...

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Summary CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and ForbiddenAnnotations.Regex are never validated by any admission webhook. A Cluster Admin can persist a malformed regex to etcd without being blocked. Once stored, every Node CREATE, UPDATE, or PATCH request triggers...

GHSA-68CJ-MVG9-RGM2 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Summary CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and ForbiddenAnnotations.Regex are never validated by any admission webhook. A Cluster Admin can persist a malformed regex to etcd without being blocked. Once stored, every Node CREATE, UPDATE, or PATCH request triggers...

CVE-2026-65834 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...