GHSA-F5F4-3HH4-F54M Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the X-GitHub-Enterprise-Host request header as the GitHub Enterprise API host during GitHub App token generation. For...

stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address

Summary Stigmem allows an authenticated user to create a webhook subscription with a user-controlled deliveryaddress. That value is stored and later used directly by the subscription delivery worker as the destination of a server-side HTTP POST request. The codebase already contains an outbound...

GHSA-5P3M-VHH6-9236 stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address

Summary Stigmem allows an authenticated user to create a webhook subscription with a user-controlled deliveryaddress. That value is stored and later used directly by the subscription delivery worker as the destination of a server-side HTTP POST request. The codebase already contains an outbound...

CVE-2026-76878

A flaw was found in OpenStack Aodh and Watcher. In Aodh, the alarm listing API does not correctly enforce project scope when the allprojects query parameter is present with a false value. A non-admin authenticated user can list alarms belonging to other projects, potentially exposing alarm...

EUVD-2026-63256

The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/callwebhook.ts issues axios.request with that url, t...

CVE-2026-64849

A flaw was found in MLflow. An unauthenticated remote attacker can exploit a Server-Side Request Forgery SSRF vulnerability by sending a specially crafted request to the webhook test endpoint. This occurs because the system validates only the initial URL, but then follows unvalidated HTTP...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: yunikorn-k8shim, azure-service-operator, kubeflow-pipelines, opentelemetry-operator, openbao, kots, cloud-provider-azure, cluster-autoscaler, kubescape, cluster-api-gcp-controller, metallb, cluster-api-helm-controller, flux-helm-controller, kube-state-metrics,...

cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests...

PT-2026-78923

The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call webhook.ts issues axios.request with that url,...

PT-2026-80743

Name of the Vulnerable Software and Affected Versions Pipelines-as-Code versions prior to 0.48.0 Description Installations using the GitHub App provider are susceptible to credential exfiltration via the webhook endpoint. The system accepted the X-GitHub-Enterprise-Host request header as the API...

Missing Authentication for Critical Function

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the monitor endpoint, which does not validate incomi...

CVE-2026-76878

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

CVE-2026-76878

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

CVE-2026-76878

CVE-2026-76878 affects OpenStack Aodh (before 22.0.1) and OpenStack Watcher (since Ussuri/Watcher 4.0.0). In Aodh, the alarm list API checks for the presence of the all_projects key rather than its value, so setting it to false removes the key and skips project-scoping logic. A non-admin user wit...

CVE-2026-76878

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

CVE-2026-76878

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

CVE-2026-76878

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

CVE-2026-68558

Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery...

CVE-2026-68558 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)

Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery...

EUVD-2026-62701

Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery...