CVE-2026-54351 Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in externalTrigger allows an attacker to overwrite the interna...

Malicious code in pdf-converter-pro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b3a5f6d1d39c20feca11d0129f0efa21bdf564586045555b756cc25bce73efc Package is advertised as a PDF converter but contains no PDF generation code. Its sole public method TXTtoPDFConverter.createpdftxtpath, pdfpath is...

MAL-2026-6541 Malicious code in pdf-converter-pro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b3a5f6d1d39c20feca11d0129f0efa21bdf564586045555b756cc25bce73efc Package is advertised as a PDF converter but contains no PDF generation code. Its sole public method TXTtoPDFConverter.createpdftxtpath, pdfpath is...

CVE-2026-56823

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the POST /api/integrations/webhooks/webhookid/ping endpoint fetches the target webhook by primary key alone without verifying that the webhook belongs to the...

EUVD-2026-39797

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the POST /api/integrations/webhooks/webhookid/ping endpoint fetches the target webhook by primary key alone without verifying that the webhook belongs to the...

CVE-2026-56823

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the POST /api/integrations/webhooks/webhookid/ping endpoint fetches the target webhook by primary key alone without verifying that the webhook belongs to the...

CVE-2026-56823

The CVE-2026-56823 affects AutoGPT: the POST /api/integrations/webhooks/{webhook_id}/ping endpoint authenticates by primary key only, allowing an authenticated user to enumerate webhook existence, leak the OAuth provider type, and potentially trigger a ping on behalf of another user due to insuff...

CVE-2026-56823 AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the POST /api/integrations/webhooks/webhookid/ping endpoint fetches the target webhook by primary key alone without verifying that the webhook belongs to the...

CVE-2026-56823 AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the POST /api/integrations/webhooks/webhookid/ping endpoint fetches the target webhook by primary key alone without verifying that the webhook belongs to the...

CVE-2026-13322

A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine, which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the...

PT-2026-57344

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions prior to 2.2.5 Description The software fails to redact sensitive information when returning resource objects. Authenticated administrators or Personal Access Tokens PAT with nezha:ddns:read or nezha:notification:read...

GO-2026-5753 New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api

New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api...

GO-2026-5654 In monetr, unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation in github.com/monetr/monetr

In monetr, unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation in github.com/monetr/monetr...

GO-2026-5734 Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint in github.com/mattermost/mattermost-plugin-msteams

Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint in github.com/mattermost/mattermost-plugin-msteams...

GO-2026-5535 Casdoor vulnerable to SSRF via crafted Webhook URL in github.com/casdoor/casdoor

Casdoor vulnerable to SSRF via crafted Webhook URL in github.com/casdoor/casdoor...

GO-2026-5605 Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine in github.com/gotenberg/gotenberg

Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine in github.com/gotenberg/gotenberg...

GO-2026-5603 Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation in github.com/lin-snow/ech0

Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2026-5508 axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification in github.com/getaxonflow/axonflow-sdk-go

axonflow-sdk-go: Webhook signing-key HMAC-SHA256 not exposed by SDK type, preventing signature verification in github.com/getaxonflow/axonflow-sdk-go...

GO-2026-5462 Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor in github.com/argoproj/argo-workflows

Argo Vulnerable to Unauthenticated Memory Exhaustion DoS in Webhook Interceptor in github.com/argoproj/argo-workflows...

CVE-2026-56767

Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users' robots and OAuth tokens. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute...