CVE-2026-57953

Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations by accessing the eventingimportautomaticwebhook endpoint registered under spectator-permitted middleware. Attackers with spectator role can...

EUVD-2026-40138

Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations by accessing the eventingimportautomaticwebhook endpoint registered under spectator-permitted middleware. Attackers with spectator role can...

CVE-2026-57953

The vulnerability affects Mythic prior to version 3.4.0.60 and is due to an authorization bypass that allows authenticated spectator-role users to perform unauthorized write operations via the eventing_import_automatic_webhook endpoint registered under spectator-permitted middleware. Exploitation...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: vault, snyk-cli, argo-workflows-fips, kubevela-fips, containerd, argo-workflows, frankenphp-8.3, terraform, rancher-agent, omnictl-multiarch-fips, kubernetes-dashboard, kots, tekton-pipelines, trivy-operator-fips, zitadel, etcd-fips, seaweedfs-rocksdb,...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.2.0), org.kie.kogito:integration-tests-jobs-service-quarkus-knative-eventing (>=1.33.0.final, <=1.34.0.final) +15 more potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.2.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

GHSA-78H2-9FRX-2JM8 vulnerabilities

Vulnerabilities for packages: spiffe-helper, commercial-chainloop-cli, cert-manager-fips, google-guest-agent-manager, tflint-fips, podman, falcosidekick-fips, step-ca-fips, zitadel, kubo, cosign-fips, grafana-pyroscope, kyverno-fips, percona-server-mongodb-operator, tekton-chains, sftpgo, packer,...

Konica Bizhub Multifunction Printers Server-Side Request Forgery (CVE-2024-51981)

An unauthenticated attacker may perform a blind server side request forgery SSRF, due to a CLRF injection issue that can be leveraged to perform HTTP request smuggling. This SSRF leverages the WS-Addressing feature used during a WS-Eventing subscription SOAP operation. The attacker can control al...

CVE-2019-11466

In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access...

EUVD-2009-0425

Malware in sbrugna...

EUVD-2019-3139

Malware in sbrugna...

EUVD-2024-54701

Malicious code in bioql PyPI...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.0, confluent-common-docker, nats, hivemind, gitsign, karma-fips, prometheus-adapter, docker-credential-ecr-login, cluster-api, linkerd2-proxy-init, sftpgo-plugin-geoipfilter, etcd-fips, karpenter, cloud-provider-aws, cloud-provider-aws-fips,...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.0, confluent-common-docker, nats, hivemind, gitsign, karma-fips, prometheus-adapter, docker-credential-ecr-login, cluster-api, linkerd2-proxy-init, sftpgo-plugin-geoipfilter, etcd-fips, karpenter, cloud-provider-aws, cloud-provider-aws-fips,...

CVE-2024-51981

An unauthenticated attacker may perform a blind server side request forgery SSRF, due to a CLRF injection issue that can be leveraged to perform HTTP request smuggling. This SSRF leverages the WS-Addressing feature used during a WS-Eventing subscription SOAP operation. The attacker can control al...

CVE-2024-51981

CVE-2024-51981 describes an unauthenticated SSRF via a CLRF injection that can be exploited during a WS-Eventing SOAP subscription (WS-Addressing). The issue allows an attacker to control all HTTP data sent in the SSRF connection but cannot receive data from the connection, enabling network-bound...

CVE-2024-51981 Unauthenticated Server Side Request Forgery (SSRF) via WS-Eventing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, and Toshiba Tec, and Konica Minolta, Inc.

An unauthenticated attacker may perform a blind server side request forgery SSRF, due to a CLRF injection issue that can be leveraged to perform HTTP request smuggling. This SSRF leverages the WS-Addressing feature used during a WS-Eventing subscription SOAP operation. The attacker can control al...

CVE-2024-51981: Server-Side Request Forgery (SSRF)

An unauthenticated attacker may perform a blind server side request forgery SSRF, due to a CLRF injection issue that can be leveraged to perform HTTP request smuggling. This SSRF leverages the WS-Addressing feature used during a WS-Eventing subscription SOAP operation. The attacker can control al...

GO-2023-2388 eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations in knative.dev/eventing-github

eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations in knative.dev/eventing-github...

GHSA-99JV-8292-2HPM eventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operations

Impact The eventing-gitlab cluster-local server doesn't set ReadHeaderTimeout‬‭ which could lead do a DDoS‬ ‭attack, where a large group of users send requests to the server causing the server to hang‬ ‭for long enough to deny it from being available to other users, also know as a Slowloris‬...

eventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operations

Impact The eventing-gitlab cluster-local server doesn't set ReadHeaderTimeout‬‭ which could lead do a DDoS‬ ‭attack, where a large group of users send requests to the server causing the server to hang‬ ‭for long enough to deny it from being available to other users, also know as a Slowloris‬...