CVE-2026-74242

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability al...

GHSA-5FPJ-28RV-84R7 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

GO-2025-3522 vulnerabilities

Vulnerabilities for packages: rancher-webhook-fips, rancher-agent...

GO-2024-2536 vulnerabilities

Vulnerabilities for packages: rancher-webhook...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: kyverno, zitadel, fluxcd-kustomize-mutating-webhook, telegraf, commercial-kyverno, cosmo-router-fips, karma-fips, karma, fluxcd-kustomize-mutating-webhook-fips, cosmo-router...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: kyverno, zitadel, fluxcd-kustomize-mutating-webhook, telegraf, commercial-kyverno, cosmo-router-fips, karma-fips, karma, fluxcd-kustomize-mutating-webhook-fips, cosmo-router...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: kyverno, zitadel, fluxcd-kustomize-mutating-webhook, telegraf, commercial-kyverno, cosmo-router-fips, karma-fips, karma, fluxcd-kustomize-mutating-webhook-fips, cosmo-router...

GO-2024-3282 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr, cert-manager-cmctl, cert-exporter-fips, cert-manager-webhook-pdns-fips, step-issuer-fips, cert-exporter, aws-privateca-issuer, step-issuer, aws-privateca-issuer-fips, cert-manager-webhook-pdns, cert-manager-cmctl-fips...

GO-2024-2428 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: karma, fluxcd-kustomize-mutating-webhook, kyverno, telegraf...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: karma, fluxcd-kustomize-mutating-webhook, kyverno, telegraf...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: karma, fluxcd-kustomize-mutating-webhook, kyverno, telegraf...

GO-2025-3465 vulnerabilities

Vulnerabilities for packages: ip-masq-agent, kubernetes-csi-driver-hostpath, spark-operator, kapp, nodetaint, rancher-fleet, aws-efs-csi-driver, kubernetes, kubernetes-dns-node-cache, vcluster, argocd-image-updater, kubernetes-csi-driver-nfs, yunikorn-k8shim, local-static-provisioner, emissary,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: promxy, kiali, nri-mssql, opentofu, src-fingerprint, prometheus-adapter, kubernetes-csi-node-driver-registrar, delve, rancher, crossplane-provider-aws-dynamodb, neuvector-scanner, opa-envoy, terragrunt, harbor-registry, pulumi-kubernetes-operator, cass-operator,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: k8sgateway, rabbitmq-messaging-topology-operator, bom, minio-object-browser, flux-image-automation-controller, nri-postgresql, opencost, opentofu, src-fingerprint, terraform, wgcf, dex, kube-vip-cloud-provider, crossplane-provider-aws-dynamodb, git-lfs, external-dns,...

EUVD-2026-58502

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...

VulnCheck KEV: CVE-2026-45298

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy the documented quickstart, no DOZZLEAUTHPROVIDER set, POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that...

PT-2026-72130

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description A flaw exists in the Stripe billing webhook handler. An unauthenticated attacker can forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint. The system...

PT-2026-72128

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description An Insecure Direct Object Reference IDOR exists where a repository administrator can access notification configurations of other repositories by knowing or guessing the Universally Uniqu...