CVE-2026-63428

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, completeSubmission accepts a hiddenFields: id, name, value array from the submitter and stores it verbatim in submission.hiddenFields, without validating the supplied id/name against the form's declared form.hiddenFields schema...

CVE-2026-45298

Dozzle (a realtime Docker container log viewer) prior to 10.5.2 contains a pre-authentication SSRF (CWE-918) via POST /api/notifications/test-webhook. In the default deployment (no DOZZLE_AUTH_PROVIDER set), this endpoint is unauthenticated and forwards an attacker-controlled URL and headers into...