3422 matches found
CVE-2026-41323
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has n...
CVE-2026-41688
Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF fix in Wallos validates webhook URLs via gethostbyname but passes the original hostname to cURL without CURLOPTRESOLVE pinning on 10 of 11 outbound HTTP endpoints, leaving a DNS...
CVE-2026-45298
Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy the documented quickstart, no DOZZLEAUTHPROVIDER set, POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that...
CVE-2026-42294
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the...
CVE-2026-46511
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the /system/api/connectionSettings endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover...
CVE-2026-42231
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modi...
CVE-2026-2393
A Server-Side Request Forgery SSRF vulnerability exists in MLflow versions prior to 3.9.0. The createwebhook function in mlflow/server/handlers.py accepts a user-controlled url parameter without validation, and the sendwebhookrequest function in mlflow/webhooks/delivery.py sends HTTP POST request...
CVE-2026-8431
An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax. This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior...
EUVD-2026-34890
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the /system/api/connectionSettings endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover...
CVE-2026-46511
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the /system/api/connectionSettings endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover...
VulnCheck KEV: CVE-2026-31816
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any...
GHSA-H524-452V-82P9 vulnerabilities
Vulnerabilities for packages: runc, nri-kubernetes, net-kourier, crossplane-provider-aws-cloudfront, kubernetes-replicator, authservice, spark-operator, mattermost, kubescape-operator, secrets-store-csi-driver, stakater-reloader, cluster-proportional-autoscaler, opentofu, newrelic-infra-operator,...
CVE-2026-42504 vulnerabilities
Vulnerabilities for packages: runc, nri-kubernetes, net-kourier, crossplane-provider-aws-cloudfront, kubernetes-replicator, authservice, spark-operator, mattermost, kubescape-operator, secrets-store-csi-driver, stakater-reloader, cluster-proportional-autoscaler, opentofu, newrelic-infra-operator,...
GHSA-H3GM-Q7M7-MP28 vulnerabilities
Vulnerabilities for packages: litestream, glab, runc, nri-kubernetes, net-kourier, crossplane-provider-aws-cloudfront, kubernetes-replicator, authservice, spark-operator, kubeflow-katib, victoriametrics-cluster, mattermost, aws-flb-cloudwatch, sigstore-scaffolding, bank-vaults, harbor,...
CVE-2026-42507 vulnerabilities
Vulnerabilities for packages: litestream, glab, runc, nri-kubernetes, net-kourier, crossplane-provider-aws-cloudfront, kubernetes-replicator, authservice, spark-operator, kubeflow-katib, victoriametrics-cluster, mattermost, aws-flb-cloudwatch, sigstore-scaffolding, bank-vaults, harbor,...
GHSA-4279-Q6MJ-392R vulnerabilities
Vulnerabilities for packages: litestream, glab, runc, nri-kubernetes, net-kourier, crossplane-provider-aws-cloudfront, kubernetes-replicator, authservice, spark-operator, kubeflow-katib, victoriametrics-cluster, mattermost, aws-flb-cloudwatch, sigstore-scaffolding, bank-vaults, harbor,...
CVE-2026-27145 vulnerabilities
Vulnerabilities for packages: litestream, glab, runc, nri-kubernetes, net-kourier, crossplane-provider-aws-cloudfront, kubernetes-replicator, authservice, spark-operator, kubeflow-katib, victoriametrics-cluster, mattermost, aws-flb-cloudwatch, sigstore-scaffolding, bank-vaults, harbor,...
CVE-2026-42504 vulnerabilities
Vulnerabilities for packages: kubevirt-cdi-apiserver, cilium-certgen, db-operator, timoni, runc, crossplane-provider-aws-guardduty, tekton-pipelines-fips, sonobuoy-fips, longhorn-share-manager, traefik, crossplane-provider-aws-autoscaling-fips, crossplane-provider-aws-emrserverless-fips,...
GHSA-H524-452V-82P9 vulnerabilities
Vulnerabilities for packages: kubevirt-cdi-apiserver, cilium-certgen, db-operator, timoni, runc, crossplane-provider-aws-guardduty, tekton-pipelines-fips, sonobuoy-fips, longhorn-share-manager, traefik, crossplane-provider-aws-autoscaling-fips, crossplane-provider-aws-emrserverless-fips,...
CVE-2026-42507 vulnerabilities
Vulnerabilities for packages: kubevirt-cdi-apiserver, mc-fips, cilium-certgen, db-operator, timoni, runc, moby-ryuk-fips, crossplane-provider-aws-guardduty, tekton-pipelines-fips, sonobuoy-fips, longhorn-share-manager, traefik, crossplane-provider-aws-autoscaling-fips,...