CVE-2026-45298 Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy the documented quickstart, no DOZZLEAUTHPROVIDER set, POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that...

CVE-2026-30839 Wallos: SSRF via webhook test endpoint

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against private/reserved IP ranges, enabling full-read SSRF. The server response is returned to the caller. This issue has been patched in...

CVE-2026-30839 Wallos: SSRF via webhook test endpoint

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against private/reserved IP ranges, enabling full-read SSRF. The server response is returned to the caller. This issue has been patched in...

CVE-2026-30839 Wallos: SSRF via webhook test endpoint

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against private/reserved IP ranges, enabling full-read SSRF. The server response is returned to the caller. This issue has been patched in...

CVE-2024-41664

Canarytokens help track activity and actions on a network. Prior to sha-8ea5315, Canarytokens.org was vulnerable to a blind SSRF in the Webhook alert feature. When a Canarytoken is created, users choose to receive alerts either via email or via a webhook. If a webhook is supplied when a Canarytok...

MAL-2023-8438 Malicious code in jotform-webhook-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 79c05d67fd61e4cb82e93b3c98181d7cc58e89c7dab47e8aab381f60211ef6db The OpenSSF Package Analysis project identified 'jotform-webhook-test' @ 1.0.0 npm as malicious. It is considered malicious because: - The packa...

Malicious code in jotform-webhook-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 79c05d67fd61e4cb82e93b3c98181d7cc58e89c7dab47e8aab381f60211ef6db The OpenSSF Package Analysis project identified 'jotform-webhook-test' @ 1.0.0 npm as malicious. It is considered malicious because: - The packa...