CVE-2026-64849

CVE-2026-64849 More POST /api/2.0/mlflow/webhooks HTTP/1.1 Host: Content-Type: application/json "url": "https://httpbin.org/redirect-to?url=http://169.254.169.254/latest/meta-data/", "name": "poc", "events": "action": "CREATED", "entity": "REGISTEREDMODEL" POST /api/2.0/mlflow/webhooks/id/test...

sentinel-mcp

SentinelMCP — AI-Powered Cyber Defense System Google Cloud Hackathon submission — Autonomous threat detection and remediation orchestrated by Google Cloud Agent Builder Vertex AI Agent , powered by Gemini 2.0 Flash, Model Context Protocol MCP, and Dynatrace observability. The Problem Security tea...

GitLab-SSRF-CVE-2021-22214

CVE-2021-22214 POC for CVE-2021-22214: Gitlab SSRF Description The remote GitLab install contains a Server-side request forgery SSRF vulnerability as a result of the internal network for webhooks being enabled. A remote, unauthenticated attacker can exploit a registration-limited GitLab instance...

GitSecure

GitSecure About GitSecure GitSecure is a GitHub action that can be used to alert security teams of any exposed API keys for push and pull requests. When files are added or modified on a GitHub repo, this action will be initiated and will start looking for exposed credentials in the system. After...

gitlab-ssrf

GitLab SSRF This repository is a reproduction of CVE-2018-19571, and how when combined with a CRLF injection exploit, can lead to remote code execution RCE. CVE Details CVE-2018-19571 GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable...

CVE-2026-22874-PoC

CVE-2026-22874 — Gitea SSRF PoC ⚠️ DISCLAIMER : This PoC is ONLY for authorized testing on Gitea instances = 1.26.3 Legal Use Cases Security research with explicit authorization Testing in lab/development Validation of mitigations Mitigations If You Can't Patch 1. Disable webhooks entirely 2...

n8n Webhooks - Remote Code Execution

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker,...

CVE-2026-114074

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed...

EUVD-2026-107025

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed...

PT-2026-120200

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed...

GO-2026-6733 Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api

Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api...

Review.CVE-2023-5612

CVE-2023-5612 – GitLab SSRF via Webhook URL PoC & Analysis 📌 CVE Overview CVE-ID: CVE-2023-5612 Severity: High CVSS: 8.1 Base Score Type: Server-Side Request Forgery SSRF Component: GitLab CE/EE Webhooks Affected Versions: GitLab CE/EE " \ --data-urlencode "url=http://127.0.0.1:8888" ...

CVE-2026-111919

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

CVE-2026-111919

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

CVE-2026-111919 Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

CVE-2026-111919 Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

EUVD-2026-103287

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

CVE-2026-111919

Vikunja versions 0.22.0 before 2.7.0 are vulnerable to an improper access revocation flaw regarding webhooks. The root cause allows removed collaborators to continue receiving project data, specifically task titles and descriptions , via webhooks they created prior to their removal. This includes...

CVE-2026-111919: Insufficient Session Expiration

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

BIT-GHOST-2026-105682 Ghost: Server-Side Request Forgery in Webhook Trigger

Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0...