CVE-2026-85471

A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery SSRF vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such a...

CVE-2026-85471

A flaw in Quay allows an authenticated repository administrator to bypass the hostname blacklist during webhook notifications . This oversight leads to a Server-Side Request Forgery (SSRF) vulnerability, where the application can be manipulated into making requests to internal network resources, ...

CVE-2026-85471 Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable

A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery SSRF vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such a...

CVE-2026-85471

A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery SSRF vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such a...

EUVD-2026-97776

A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery SSRF vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such a...

CVE-2026-85471

A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery SSRF vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such a...

PT-2026-110886

A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery SSRF vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such a...

CVE-2026-85471: Server-Side Request Forgery (SSRF)

A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery SSRF vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such a...

bbrecon

Este proyecto ya no recibe mantenimiento y he desconectado la infraestructura de rastreo. La audiencia no era lo suficientemente amplia como para justificar su mantenimiento. Bug Bounty Recon bbrecon es un servicio gratuito de Reconocimiento como Servicio para cazadores de bugs y investigadores d...

CVE-2026-16738: Improper Access Control

The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without...

CVE-2026-30839

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against private/reserved IP ranges, enabling full-read SSRF. The server response is returned to the caller. This issue has been patched in...

Wallos code issues and vulnerabilities

Wallos is an open-source personal subscription tracker developed by Miguel Ribeiro. Versions of Wallos prior to 4.6.2 contained code vulnerabilities. These vulnerabilities stemmed from the fact that testwebhooknotifications.php did not validate the target URL against private IP ranges, which coul...

Spring into Action! Earn up to $10,000 with our Extended Bug Bounty Program Extravaganza through Memorial Day!

Spring into action and kick-start your spring cleaning with a tech twist! Were excited to announce the extension of our Bug Bounty Extravaganza through Memorial Day, May 27th, 2024. Now, you have a golden opportunity to earn up to $10,000 for reporting vulnerabilities in WordPress software over t...