CVE-2026-32096

CVE-2026-32096 SSRF via unvalidated AWS SNS SubscriptionConfirmation inuseplunk/plunk Summary The Plunk API endpoint POST /webhooks/sns fetches an attacker-supplied SubscribeURL without verifying the AWS SNS cryptographic signature. An unauthenticated attacker can force the server to make arbitra...

GO-2026-6789 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, crossplane-provider-aws-memorydb, crossplane-provider-aws-route53, crossplane-provider-azure-sql, crossplane-provider-aws-ec2, crossplane-provider-azure-authorization, crossplane-provider-aws-elasticache,...

GO-2026-6795 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, crossplane-provider-aws-memorydb, crossplane-provider-aws-route53, crossplane-provider-azure-sql, crossplane-provider-aws-ec2, crossplane-provider-azure-authorization, crossplane-provider-aws-elasticache,...

GO-2026-6783 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, crossplane-provider-aws-memorydb, crossplane-provider-aws-route53, crossplane-provider-azure-sql, crossplane-provider-aws-ec2, crossplane-provider-azure-authorization, crossplane-provider-aws-elasticache,...

GO-2026-6785 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, crossplane-provider-aws-memorydb, crossplane-provider-aws-route53, crossplane-provider-azure-sql, crossplane-provider-aws-ec2, crossplane-provider-azure-authorization, crossplane-provider-aws-elasticache,...

GO-2026-6769 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, crossplane-provider-aws-memorydb, crossplane-provider-aws-route53, crossplane-provider-azure-sql, crossplane-provider-aws-ec2, crossplane-provider-azure-authorization, crossplane-provider-aws-elasticache,...

GO-2026-6800 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, crossplane-provider-aws-memorydb, crossplane-provider-aws-route53, crossplane-provider-azure-sql, crossplane-provider-aws-ec2, crossplane-provider-azure-authorization, crossplane-provider-aws-elasticache,...

EUVD-2026-117167

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownershi...

CVE-2026-54384

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownershi...

CVE-2026-54384

The VitaFit cloud API (prior to 2026-10-30) is vulnerable to an authentication bypass in the POST /front/login/sns/ endpoint. This flaw allows remote attackers to gain a full session for a victim's account by submitting a linked Google or Facebook account identifier without providing proof of own...

CVE-2026-54384 VitaFit Cloud API Authentication Bypass via POST /front/login/sns/

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownershi...

PT-2026-137218

Name of the Vulnerable Software and Affected Versions VitaFit cloud API versions prior to 2026-10-30 Description An authentication bypass allows remote attackers to obtain a full session for a victim's account. This is achieved by submitting a linked Google or Facebook account identifier to the...

CVE-2026-113810

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator...

CVE-2026-113808

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator...

CVE-2026-111088

A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen...

EUVD-2026-105258

A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen...

CVE-2026-111088

A Stored Cross-Site Scripting (XSS) vulnerability exists in the SNS VPN log monitoring screen . This flaw (CWE-79) allows for the improper neutralization of input during web page generation. The vulnerability has a CVSS 3.1 score of 6.5 (Medium) , with a high impact on confidentiality. No specifi...

CVE-2026-111088 Stored XSS in the VPN logs monitor

A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen...

CVE-2026-111088 Stored XSS in the VPN logs monitor

A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen...

CVE-2026-113810 Stored XSS on SNS Enrollment Portal

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator...