GHSA-5FPJ-28RV-84R7 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

GO-2025-3522 vulnerabilities

Vulnerabilities for packages: rancher-agent, rancher-webhook-fips...

GO-2024-2536 vulnerabilities

Vulnerabilities for packages: rancher-webhook...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: zitadel, fluxcd-kustomize-mutating-webhook-fips, telegraf, commercial-kyverno, kyverno, karma, karma-fips, cosmo-router, fluxcd-kustomize-mutating-webhook, cosmo-router-fips...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: zitadel, fluxcd-kustomize-mutating-webhook-fips, telegraf, commercial-kyverno, kyverno, karma, karma-fips, cosmo-router, fluxcd-kustomize-mutating-webhook, cosmo-router-fips...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: zitadel, fluxcd-kustomize-mutating-webhook-fips, telegraf, commercial-kyverno, kyverno, karma, karma-fips, cosmo-router, fluxcd-kustomize-mutating-webhook, cosmo-router-fips...

GO-2024-3282 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns-fips, step-issuer-fips, cert-manager-webhook-pdns, aws-privateca-issuer, cert-manager-cmctl-fips, cert-exporter, cert-manager-cmctl, step-issuer, cert-exporter-fips, aws-privateca-issuer-fips, cert-manager-istio-csr...

GO-2024-2428 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: karma, telegraf, kyverno, fluxcd-kustomize-mutating-webhook...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: karma, telegraf, kyverno, fluxcd-kustomize-mutating-webhook...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: karma, telegraf, kyverno, fluxcd-kustomize-mutating-webhook...

GO-2025-3465 vulnerabilities

Vulnerabilities for packages: vcluster, kubernetes-csi-driver-nfs, nodetaint, yunikorn-k8shim, kapp, ip-masq-agent, argocd-image-updater, kubernetes, kubernetes-csi-driver-hostpath, argo-rollouts, local-static-provisioner, aws-efs-csi-driver, spark-operator, rancher-fleet, emissary,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: nri-couchbase, guac, neuvector-scanner, litefs, opentofu, crossplane-provider-aws-rds, azcopy, rancher-fleet, vault-benchmark, apisix-ingress-controller, nri-kubernetes, tekton-chains, act, cluster-autoscaler, docker-machine-driver-linode, step-issuer, db-operator,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: step-kms-plugin, nri-couchbase, guac, cert-manager-cmctl, cfssl, cloud-provider-vsphere, litefs, scorecard, opentofu, timescaledb-parallel-copy, crossplane-provider-aws-rds, azcopy, metacontroller, boring-registry, lazygit, vault-benchmark,...

EUVD-2026-58502

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...

PT-2026-72128

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description An Insecure Direct Object Reference IDOR exists where a repository administrator can access notification configurations of other repositories by knowing or guessing the Universally Uniqu...

VulnCheck KEV: CVE-2026-45298

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy the documented quickstart, no DOZZLEAUTHPROVIDER set, POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that...

PT-2026-72130

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description A flaw exists in the Stripe billing webhook handler. An unauthenticated attacker can forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint. The system...

CVE-2026-74244: Improper Verification of Cryptographic Signature

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...