VulnCheck KEV: CVE-2026-31816

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: nova, timoni, external-secrets-operator, dynamic-localpv-provisioner, rancher-webhook, crossplane-provider-family-azure, multus-cni, nri-discovery-kubernetes, falco-no-driver, knative-eventing, opentofu, crossplane-provider-aws-cloudfront, promxy, crossplane,...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: nova, timoni, external-secrets-operator, dynamic-localpv-provisioner, rancher-webhook, crossplane-provider-family-azure, multus-cni, nri-discovery-kubernetes, falco-no-driver, knative-eventing, opentofu, crossplane-provider-aws-cloudfront, promxy, crossplane,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: nova, newrelic-nri-statsd, envconsul, timoni, neuvector-dbgen, nri-mssql, hcloud, external-secrets-operator, dynamic-localpv-provisioner, harbor, rancher-webhook, gostatsd, temporal-server, crossplane-provider-family-azure, vault-benchmark, multus-cni,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: nova, newrelic-nri-statsd, envconsul, timoni, neuvector-dbgen, nri-mssql, hcloud, external-secrets-operator, dynamic-localpv-provisioner, harbor, rancher-webhook, gostatsd, nri-postgresql, crossplane-provider-family-azure, temporal-server, multus-cni,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: nova, newrelic-nri-statsd, envconsul, timoni, neuvector-dbgen, nri-mssql, hcloud, external-secrets-operator, dynamic-localpv-provisioner, harbor, rancher-webhook, gostatsd, nri-postgresql, crossplane-provider-family-azure, temporal-server, multus-cni,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: nova, newrelic-nri-statsd, envconsul, timoni, neuvector-dbgen, nri-mssql, hcloud, external-secrets-operator, dynamic-localpv-provisioner, harbor, rancher-webhook, gostatsd, temporal-server, crossplane-provider-family-azure, vault-benchmark, multus-cni,...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, kubeflow-pipelines, crossplane-provider-aws-servicediscovery, prometheus-fips, kubernetes-csi-node-driver-registrar-fips, kubevirt-cdi-controller, redka, crossplane-provider-azure-portal, nfs-subdir-external-provisioner,...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, kubeflow-pipelines, crossplane-provider-aws-servicediscovery, prometheus-fips, kubernetes-csi-node-driver-registrar-fips, kubevirt-cdi-controller, redka, crossplane-provider-azure-portal, nfs-subdir-external-provisioner,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, kubeflow-pipelines, crossplane-provider-aws-servicediscovery, prometheus-fips, kubernetes-csi-node-driver-registrar-fips, kubevirt-cdi-controller, redka, crossplane-provider-azure-portal, nfs-subdir-external-provisioner,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, kubeflow-pipelines, crossplane-provider-aws-servicediscovery, prometheus-fips, kubernetes-csi-node-driver-registrar-fips, kubevirt-cdi-controller, redka, crossplane-provider-azure-portal, nfs-subdir-external-provisioner,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, kubeflow-pipelines, crossplane-provider-aws-servicediscovery, prometheus-fips, kubernetes-csi-node-driver-registrar-fips, kubevirt-cdi-controller, redka, crossplane-provider-azure-portal, nfs-subdir-external-provisioner,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, kubeflow-pipelines, crossplane-provider-aws-servicediscovery, prometheus-fips, kubernetes-csi-node-driver-registrar-fips, kubevirt-cdi-controller, redka, crossplane-provider-azure-portal, nfs-subdir-external-provisioner,...

PT-2026-46853

Summary plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance without...

CVE-2026-10273

A vulnerability was found in php-censor up to 2.1.6. This affects an unknown function of the file src/Model/Build/GitBuild.php of the component Webhook Endpoint. Performing a manipulation of the argument commitId results in os command injection. The attack can be initiated remotely. The exploit h...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the resolveAuth function of the Webhook Verification Handler. An attacker can gain unauthorized access and potentially compromise confidentiality, integrity, and availability by sending...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the resolveAuth function of the Webhook Verification Handler. An attacker can gain unauthorized access and potentially compromise confidentiality, integrity, and availability by sending...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the resolveAuth function of the Webhook Verification Handler. An attacker can gain unauthorized access and potentially compromise confidentiality, integrity, and availability by sending...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the resolveAuth function of the Webhook Verification Handler. An attacker can gain unauthorized access and potentially compromise confidentiality, integrity, and availability by sending...

CVE-2026-10617

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possibl...