PT-2026-110579

Name of the Vulnerable Software and Affected Versions Progress ShareFile Storage Zones Controller versions prior to 5.12.7 Description Processing of queue items can send acknowledgements to an unvalidated callback URL. This behavior, combined with a race condition, allows an attacker to force the...

PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl

Summary PinchTab v0.8.3 contains a server-side request forgery issue in the optional scheduler's webhook delivery path. When a task is submitted to POST /tasks with a user-controlled callbackUrl, the v0.8.3 scheduler sends an outbound HTTP POST to that URL when the task reaches a terminal state. ...