CVE-2026-47837

A flaw was found in Spring Cloud Config Server. This vulnerability allows an unauthenticated remote attacker to send webhook requests to the /monitor endpoint without validation. This lack of authentication for a critical function could lead to a denial of service DoS condition, making the server...

MAL-2026-16121 Malicious code in websetup (PyPI)

[email protected] is a single module whose only function, setup.settext=None, filepath=None in websetup/sender.py, POSTs the given text and the contents of any local file path to a hardcoded Discord webhook id 1546817174411288617; the name Discord returns for it is "backdoor" and swallows every...

Malicious code in websetup (PyPI)

[email protected] is a single module whose only function, setup.settext=None, filepath=None in websetup/sender.py, POSTs the given text and the contents of any local file path to a hardcoded Discord webhook id 1546817174411288617; the name Discord returns for it is "backdoor" and swallows every...

PT-2026-89209

Description Before 1.22, if the Basic Auth htpasswd middleware was not configured, all incoming HTTP headers were blindly forwarded to the webhook script execution environment as shell variables. While the Basic Auth middleware correctly strips the authentication header X-WebAuthn-User from the...

Security Bulletin: IBM Fusion Data Foundation is vulnerable to Denial of Service.

Summary Argo CD is used by IBM Fusion Data Foundation, which could cause a Denial of Service. CVE-2025-55191, CVE-2025-59531, CVE-2025-59537, CVE-2025-59538. Vulnerability Details CVEID:CVE-2025-55191 DESCRIPTION: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions...

CVE-2026-86080

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and...

CVE-2026-86080 n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and...

CVE-2026-86080 n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and...

CVE-2026-86080

n8n , an open source workflow automation platform, is affected by a fail-open signature verification flaw in its GitHub Trigger . When GitHub returns HTTP 422 and the node reuses an existing webhook, the generated webhook secret is discarded , leaving workflow static data with a webhookId but no ...

CVE-2026-86080 n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and...

Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher

Summary The isBlockedIP SSRF guard in Dozzle's webhook notification dispatcher blocks loopback, link-local, multicast, and unspecified addresses but does not recognize IPv6 transition mechanism addresses RFC 3056 6to4, RFC 6052 NAT64, RFC 4380 Teredo that embed arbitrary IPv4 addresses. An...

EUVD-2026-56556

Dozzle: SSRF guard bypass via IPv6 transition addresses 6to4/NAT64/Teredo in webhook notification dispatcher...

GHSA-P2W3-6X73-2F6X Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher

Summary The isBlockedIP SSRF guard in Dozzle's webhook notification dispatcher blocks loopback, link-local, multicast, and unspecified addresses but does not recognize IPv6 transition mechanism addresses RFC 3056 6to4, RFC 6052 NAT64, RFC 4380 Teredo that embed arbitrary IPv4 addresses. An...

Exploit for CVE-2026-73316

CVE-2026-73316 XenForo before 2.3.13 processes the same valid...

Exploit for CVE-2026-73315

CVE-2026-73315 XenForo before 2.3.13 fetches the certificate...

Exploit for CVE-2026-73314

CVE-2026-73314 XenForo before 2.3.13 fails open when a PayPal...

Server-side Request Forgery (SSRF)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the ExternalUrl validation process. An attacker can access internal services or cloud metadata endpoints by configuring webhook URLs with...

CVE-2026-86735 snipe-it before 8.7.0 SSRF via IPv6 transition address bypass

snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo...

CVE-2026-86735 snipe-it before 8.7.0 SSRF via IPv6 transition address bypass

snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo...

CVE-2026-86735

snipe-it versions before 8.7.0 contain a server-side request forgery (SSRF) vulnerability in the ExternalUrl validation rule , which fails to detect IPv6 transition addresses (NAT64, 6to4, or Teredo) that encode private IPv4 targets. An attacker with super-admin privileges can configure webhook U...