PT-2026-69111

Name of the Vulnerable Software and Affected Versions Grav CMS scheduler-webhook plugin affected versions not specified Description An authentication bypass exists in the webhook token check of the scheduler-webhook plugin. When the webhook feature is enabled but no webhookToken is configured, th...

CVE-2026-15732

A Server-Side Request Forgery SSFR vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses...

CVE-2026-15732

A Server-Side Request Forgery (SSRF) vulnerability exists in WGDashboard version 4.2.3 and earlier . The flaw resides in the webhook functionality , which allows authenticated attackers to perform arbitrary HTTP requests and retrieve the resulting responses. The documents do not provide specific ...

CVE-2026-15732 WGDashboard Server-Side Request Forgery Vulnerability

A Server-Side Request Forgery SSFR vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses...

CVE-2026-70646

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

CVE-2026-70646

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

EUVD-2026-53920

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

CVE-2026-70646

CVE-2026-70646 concerns the aiosend Crypto Pay API client. Before version 3.0.7, WebhookHandler.feed_update() deserializes the entire request body prior to HMAC verification, enabling an unauthenticated attacker to trigger expensive JSON parsing and cause CPU/memory exhaustion (pre-auth DoS). The...

CVE-2026-70646 aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

CVE-2026-70646 aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

CVE-2026-70646 aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

PT-2026-68655

Name of the Vulnerable Software and Affected Versions WGDashboard versions prior to 4.2.4 Description A Server-Side Request Forgery SSRF issue exists within the webhook functionality. This allows authenticated attackers to initiate arbitrary HTTP requests and retrieve the resulting responses from...

CVE-2026-15732: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSFR vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses...

CVE-2026-70437

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...

CVE-2026-70437

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...

CVE-2026-70437

The Jenkins Webhook Secret Credentials Provider Plugin version 16.v0cfa_f0215cf5 and earlier is vulnerable to a timing attack because it fails to use a constant-time comparison function when validating webhook bearer tokens. This flaw could allow an attacker to use statistical methods to derive a...

CVE-2026-70437

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...

EUVD-2026-53531

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...

CVE-2026-70437

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...

Malicious code in stellar-api-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd4c86bebaa61a9aada2c1686d68eb5119025ea4646426ea7da3db4ce4208707 The package's constructor unconditionally appends a hardcoded Discord user ID 1489655840662093854 to the caller-supplied adminIds list, granting that...