Malicious code in supplyhub (npm)

The npm package supplyhub is a credential / SSH-key stealer. Its package.json declares a postinstall lifecycle hook postinstall: node postinstall.js that executes automatically on npm install, before the package is ever imported. postinstall.js uses fs.readFileSync to read the user's SSH private...

MAL-2026-10938 Malicious code in twiliointernal-messaging-toolbox (npm)

The twiliointernal-messaging-toolbox package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

MAL-2026-10931 Malicious code in org-twilio-phone-numbers-utils (npm)

The org-twilio-phone-numbers-utils package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

MAL-2026-10932 Malicious code in twilio-assets (npm)

The twilio-assets package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

MAL-2026-11043 Malicious code in supplyhub (npm)

The npm package supplyhub is a credential / SSH-key stealer. Its package.json declares a postinstall lifecycle hook postinstall: node postinstall.js that executes automatically on npm install, before the package is ever imported. postinstall.js uses fs.readFileSync to read the user's SSH private...

Uncontrolled Resource Consumption

github.com/zalando/skipper is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to reading the entire admission webhook request body without enforcing a size limit, which allows an attacker to send excessively large payloads and exhaust memory, resulting in a...

CVE-2026-16083

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The attack may be launched remotely. The...

CVE-2026-16083 Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The attack may be launched remotely. The...

CVE-2026-16083

Affected software: Sipeed PicoClaw up to version 0.2.9, specifically the LINE Webhook component (webhook.ParseRequest in pkg/channels/line/line.go). Vulnerability: Authentication bypass via capture-replay. Remote exploitable condition reported; exploit released publicly. Impact: Authentication by...

EUVD-2026-45359

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The attack may be launched remotely. The...

CVE-2026-16083

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The attack may be launched remotely. The...

CVE-2026-16083 Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The attack may be launched remotely. The...

CVE-2026-16083 Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The attack may be launched remotely. The...

CVE-2026-16083: Authentication Bypass by Capture-replay

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The attack may be launched remotely. The...

PT-2026-60925

Name of the Vulnerable Software and Affected Versions Sipeed PicoClaw versions prior to 0.3.0 Description An authentication bypass exists in the LINE Webhook component due to a capture-replay flaw. A remote attacker can exploit this by manipulating the webhook.ParseRequest function within the...

CVE-2026-8505

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False which is the default...

GO-2026-5985 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` in github.com/forgekeep/nebula-mesh

Nebula-mesh allows non-admin operators to disable webhook SSRF protection via allowprivate in github.com/forgekeep/nebula-mesh...

CVE-2026-8505 Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False which is the default...

CVE-2026-8505

CVE-2026-8505 affects Langflow OSS 1.0.0–1.10.0. A flaw in the webhook authentication logic bypasses API key validation when WEBHOOK_AUTH_ENABLE is False (default), allowing unauthenticated remote execution of any flow and potentially RCE/DoS. IBM’s bulletin confirms the vulnerability and that th...

EUVD-2026-45272

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False which is the default...