CVE-2026-92720 Kubero through 3.1.1 Unauthenticated Notifications API Access

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...

CVE-2026-92720: Missing Authentication for Critical Function

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...

PT-2026-93883

Name of the Vulnerable Software and Affected Versions Kubero versions prior to 3.1.2 Description Authentication guards are not applied to the notifications API endpoints, which allows unauthenticated attackers to read webhook secrets and service URLs. This flaw enables the retrieval of stored...

CVE-2026-85691

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...

PYSEC-2026-2314

Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission granted by the per-project "Administration" role can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate...

CVE-2026-27796

Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service...

Homarr security vulnerabilities

Homarr is a customizable browser homepage developed by Thomas Camlong, used to interact with the Docker containers of the main server. Versions of Homarr prior to 1.54.0 contained security vulnerabilities. These vulnerabilities stemmed from the integration.all tRPC endpoint being exposed as a...

ESM.sh security vulnerability

esm.sh is a content delivery network open-sourced by esm.sh. A security vulnerability exists in esm.sh version 136 and earlier, which stems from improper handling of service URLs and could lead to a local file inclusion attack...

CVE-2024-40636

Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service UR...

CVE-2024-40636

The CVE concerns Steeltoe.Discovery.Eureka where DiscoveryClient logs may leak basic-auth credentials because Eureka server URLs are not fully masked when FetchRegistry fails. Affects Steeltoe.Discovery.Eureka (and related packages) with multiple Eureka URLs and basic auth; root cause is logging ...

CVE-2024-40636 Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness

Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service UR...

GHSA-VMCP-66R5-3PCP Steeltoe Leaks Basic Auth Credentials to Logs After Fetch Registry Error

Summary When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked. Details Package: Steeltoe.Discovery.Eureka Package version: 3.2.1 Branc...

CVE-2024-40636: Insertion of Sensitive Information into Log File

Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service UR...