CVE-2026-8431

An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax. This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior...

EUVD-2026-34890

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the /system/api/connectionSettings endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover...

CVE-2026-46511

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the /system/api/connectionSettings endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover...

VulnCheck KEV: CVE-2026-31816

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, policy-controller, rancher-helm, azure-workload-identity-webhook, crossplane-provider-aws-cloudfront, polaris, opentofu, cloud-provider-azure, coredns, crossplane-provider-azure-storage, crossplane-provider-family-aws, pinact, cluster-api,...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, policy-controller, rancher-helm, azure-workload-identity-webhook, crossplane-provider-aws-cloudfront, polaris, opentofu, cloud-provider-azure, coredns, crossplane-provider-azure-storage, crossplane-provider-family-aws, pinact, cluster-api,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, policy-controller, rancher-helm, azure-workload-identity-webhook, crossplane-provider-aws-cloudfront, gitlab-pages, polaris, neuvector-scanner, opentofu, terraform-provider-acme, cloud-provider-azure, dbmate, ksops, kaniko, speedtest-go,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, policy-controller, rancher-helm, azure-workload-identity-webhook, crossplane-provider-aws-cloudfront, gitlab-pages, polaris, neuvector-scanner, opentofu, terraform-provider-acme, cloud-provider-azure, dbmate, ksops, kaniko, speedtest-go,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, policy-controller, rancher-helm, azure-workload-identity-webhook, crossplane-provider-aws-cloudfront, gitlab-pages, polaris, neuvector-scanner, opentofu, terraform-provider-acme, cloud-provider-azure, dbmate, ksops, kaniko, speedtest-go,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, policy-controller, rancher-helm, azure-workload-identity-webhook, crossplane-provider-aws-cloudfront, gitlab-pages, polaris, neuvector-scanner, opentofu, terraform-provider-acme, cloud-provider-azure, dbmate, ksops, kaniko, speedtest-go,...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: step-issuer-fips, crossplane-provider-aws-memorydb-fips, azure-workload-identity-webhook, kube-logging-logging-operator, crossplane-provider-aws-athena, crossplane-fips, eks-distro, crossplane-provider-aws-ssm, flannel-fips, cephcsi-fips, cert-manager-openshift-route...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: step-issuer-fips, crossplane-provider-aws-memorydb-fips, azure-workload-identity-webhook, kube-logging-logging-operator, crossplane-provider-aws-athena, crossplane-fips, eks-distro, crossplane-provider-aws-ssm, flannel-fips, cephcsi-fips, cert-manager-openshift-route...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: step-issuer-fips, crossplane-provider-aws-memorydb-fips, azure-workload-identity-webhook, kube-logging-logging-operator, crossplane-provider-aws-athena, crossplane-fips, golangci-lint, prometheus-bind-exporter, eks-distro, crossplane-provider-aws-ssm, flannel-fips,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: step-issuer-fips, crossplane-provider-aws-memorydb-fips, azure-workload-identity-webhook, kube-logging-logging-operator, crossplane-provider-aws-athena, crossplane-fips, golangci-lint, prometheus-bind-exporter, eks-distro, crossplane-provider-aws-ssm, flannel-fips,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: step-issuer-fips, crossplane-provider-aws-memorydb-fips, azure-workload-identity-webhook, kube-logging-logging-operator, crossplane-provider-aws-athena, crossplane-fips, golangci-lint, prometheus-bind-exporter, eks-distro, crossplane-provider-aws-ssm, flannel-fips,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: step-issuer-fips, crossplane-provider-aws-memorydb-fips, azure-workload-identity-webhook, kube-logging-logging-operator, crossplane-provider-aws-athena, crossplane-fips, golangci-lint, prometheus-bind-exporter, eks-distro, crossplane-provider-aws-ssm, flannel-fips,...

PT-2026-46853

Summary plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance without...

CVE-2026-10273

A vulnerability was found in php-censor up to 2.1.6. This affects an unknown function of the file src/Model/Build/GitBuild.php of the component Webhook Endpoint. Performing a manipulation of the argument commitId results in os command injection. The attack can be initiated remotely. The exploit h...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the resolveAuth function of the Webhook Verification Handler. An attacker can gain unauthorized access and potentially compromise confidentiality, integrity, and availability by sending...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the resolveAuth function of the Webhook Verification Handler. An attacker can gain unauthorized access and potentially compromise confidentiality, integrity, and availability by sending...