Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Vulnerabilities handled in IBM Langflow OSS

IBM has addressed several vulnerabilities in the IBM Langflow OSS versions from 1.0.0 to 1.10.0. The vulnerabilities in IBM Langflow OSS include: - Execution of arbitrary file modifications by authorized users through specially crafted Content-Disposition headers. - Server-side request forgery SS...

EUVD-2026-46123

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to...

PT-2026-63313

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The ToHook function in services/webhook/general.go decrypts the HeaderAuthorizationEncrypted field and returns the plaintext authorization header in the API response. This allows repository...

PT-2026-63303

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea contains an issue where the post-receive git hook handler incorrectly processes git push options on existing repositories. Users with owner or admin-collaborator access can use the...

PT-2026-63290

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description The software contains two Server-Side Request Forgery SSRF issues. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location, potentially accessing...

PT-2026-63306

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.4 Description A flaw exists where webhooks created by a collaborator with admin permissions on a private repository continue to trigger after the collaborator's access has been revoked. The DeleteCollaboration function in...

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup DeleteCollaboration removes the collaboration record, recalculates accesses, drops watches, and unassigns issues — but it...

Incorrect Implementation of Authentication Algorithm

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm via the webhook token validation process. An attacker can execute arbitrary scheduled job...

CVE-2026-57852

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to...

CVE-2026-57852 Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token Check

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to...

CVE-2026-57852 Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token Check

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to...

CVE-2026-57852

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to...

CVE-2026-57852 Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token Check

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to...

CVE-2026-57852

Affected product/Component: Grav CMS scheduler-webhook plugin. Vulnerability: Authentication bypass due to a short-circuit logic flaw in the webhook token validation, allowing unauthenticated remote attackers to trigger configured scheduled jobs. Impact (as described): An unauthenticated POST to ...

CVE-2026-44583

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request...

EUVD-2026-46089

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request...

CVE-2026-44583

Paymenter before v1.5.0 is vulnerable to blind SSRF via the PayPal webhook endpoint /extensions/paypal/webhook. The PAYPAL-CERT-URL HTTP header is read without validation and directly fed into a server-side HTTP request (file_get_contents), allowing an unauthenticated attacker to direct requests ...