Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

CVE-2022-1471 — SnakeYAML RCE lab Jira / Automation for Jira...

GHSA-5FPJ-28RV-84R7 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: cert-manager-fips, aws-ebs-csi-driver, flux-notification-controller, aws-load-balancer-controller-fips, nova-fips, grafana-operator, go, omnictl-multiarch, aws-ebs-csi-driver-fips, flux-fips, victorialogs-fips, victoriametrics-fips, flux-source-watcher, flux-operator...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: argo-events, guac, argo-workflows, k8sgpt, timoni, kubevela, tfsec, chezmoi, kubescape, zarf, src-fingerprint, grype, pulumi-language-java, apko, kots, go-licenses, goreleaser, melange, flux-image-automation-controller, trivy, dagger, syft, k9s, osv-scanner,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: argo-events, guac, argo-workflows, k8sgpt, timoni, kubevela, tfsec, chezmoi, kubescape, zarf, src-fingerprint, grype, pulumi-language-java, apko, kots, go-licenses, goreleaser, melange, flux-image-automation-controller, trivy, dagger, syft, k9s, osv-scanner,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: argo-events, guac, argo-workflows, teleport, kubevela, kyverno, tfsec, chezmoi, kubescape, gomplate, zarf, src-fingerprint, gitaly, grype, argo-cd, pulumi-language-java, apko, kots, cerbos, gitlab-runner, melange, flux-image-automation-controller,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: hcloud, spire-server, k3s, neuvector-sigstore-interface, crossplane-provider-keycloak, kyverno, terraform-provider-azurerm, prometheus, kubescape, crossplane-provider-aws-sns, zarf, apko, docker-compose, slsa-verifier, docker, docker-cli-buildx,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: dkron, k3s, spire-server, conjur-cli, neuvector-sigstore-interface, aws-eks-pod-identity-agent, vale, golangci-lint, timoni, aws-flb-cloudwatch, litefs, vault-secrets-webhook, apache-exporter, runc, dbmate, kubernetes-csi-livenessprobe, dynamic-localpv-provisioner,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: spire-server, argo-events, guac, k3s, opentelemetry-collector-contrib, neuvector-sigstore-interface, crossplane-provider-family-azure, kubevela, crossplane-provider-azure-sql, gh, crossplane-provider-azure-authorization, terraform-provider-azurerm, cosign, kubescape,...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

PT-2026-76555

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.41.3 Description Authenticated users can perform server-side requests to internal services and cloud metadata. This occurs because automation steps for outgoing webhooks, Zapier, n8n, Slack, and Discord use...

CVE-2026-72851

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...

CVE-2026-72851 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...

CVE-2026-72851

Budibase before 3.40.0 contains an unauthenticated SQL injection in webhook-triggered automations using EXECUTE_QUERY steps. An attacker can POST JSON to the webhook trigger endpoint to inject SQL payloads that run with builder-configured database credentials, enabling data exfiltration, modifica...

CVE-2026-72851 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...

CVE-2025-62314

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain condition...

EUVD-2025-210723

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain condition...

CVE-2025-62314 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain condition...

CVE-2025-62314

HCL AION is reported to have a vulnerability where certain endpoints lack sufficient anti-automation controls, allowing automated or scripted requests without proper rate limiting or challenges. The primary impact described is potential unintended behavior or security effects under specific condi...

CLEANSTART-2026-IZ22023 Security fixes in flux-image-automation-controller 1.2.1-r1

Package flux-image-automation-controller version 1.2.1-r1 fixes 13 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...