CVE-2026-58511 Webhook Authorization Header Returned in Plaintext via API

Webhook Authorization Header Returned in Plaintext via API...

CVE-2026-58511

The Git repository management system Gitea is affected by a vulnerability in the ToHook() function located in the services/webhook/general.go file. Due to access control deficiencies, an attacker can cause the Webhook Authorization Header to be returned in plaintext via the API. This vulnerabilit...

CVE-2026-58511 Webhook Authorization Header Returned in Plaintext via API

Webhook Authorization Header Returned in Plaintext via API...

EUVD-2026-58124

Webhook Authorization Header Returned in Plaintext via API...

CVE-2026-58511 Webhook Authorization Header Returned in Plaintext via API

Webhook Authorization Header Returned in Plaintext via API...

CVE-2026-58440 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...

EUVD-2026-58167

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...

CVE-2026-58440

The Git repository management system Gitea is affected by an improper access control vulnerability within the DeleteCollaboration function in services/repository/collaboration.go. Due to incomplete revocation cleanup, webhooks created by a collaborator continue to fire even after their repository...

CVE-2026-58440 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...

CVE-2026-58440 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...

CLEANSTART-2026-IL84688 Security fixes in cert-manager-webhook-pdns-fips 2.5.5-r1

Package cert-manager-webhook-pdns-fips version 2.5.5-r1 fixes 29 vulnerabilities: CVE-2026-39822, CVE-2026-42505, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830...

PT-2026-71908

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...

CVE-2026-72851: Improper Neutralization of Special Elements used in an SQL Command

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...

CVE-2026-58511: Exposure of Sensitive Information to an Unauthorized Actor

Webhook Authorization Header Returned in Plaintext via API...

PT-2026-71923

Name of the Vulnerable Software and Affected Versions OpenChoreo versions prior to 1.0.3 OpenChoreo versions prior to 1.1.3 OpenChoreo versions prior to 1.2.0-rc.2 Description The 'POST /api/v1alpha1/autobuild' endpoint in 'internal/openchoreo-api/api/handlers/webhook handler.go' allows...

CVE-2024-7598 affecting package kubernetes for versions less than 1.30.10-27

CVE-2024-7598 affecting package kubernetes for versions less than 1.30.10-27. A patched version of the package is available...

CVE-2026-42533 vulnerabilities

Vulnerabilities for packages: nginx-stable, ingress-nginx-controller, nginx-mainline...

CVE-2026-48494

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign preview phone number tied to another preview...

MAL-2026-13743 Malicious code in whs4_ued (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be723a2156cdb77cc97a0afb9ee15e4d50928a1924cd6cde69bcaacf2707a8b On npm install, the package's postinstall hook runs node index.js, which POSTs installer host information — the absolute path of the package file...

Malicious code in whs4_ued (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be723a2156cdb77cc97a0afb9ee15e4d50928a1924cd6cde69bcaacf2707a8b On npm install, the package's postinstall hook runs node index.js, which POSTs installer host information — the absolute path of the package file...