CVE-2026-42231

GHSA-q5f4-99jv-pgg5 — Contaminación de prototipos en webhook XML de n8n → RCE CVE: CVE-2026-42231 Severidad: Crítica CVSS 10.0 Afectados: n8n . xml2js 0.6.2 usa Object.defineProperty con un descriptor de datos para establecer claves de elementos en objetos analizados. Debido a que siempre es ,...

cve-2026-24514-Kubernetes-Dos

CVE-2026-24514 – Critical Memory Exhaustion in ingress-nginx Validating Admission Webhook Unauthenticated / low-privileged remote denial-of-service vulnerability allowing attackers to crash ingress-nginx controller pods via oversized AdmissionReview requests. Overview & Business Impact The...

CVE-2026-32096

CVE-2026-32096 SSRF mediante SubscriptionConfirmation de AWS SNS sin validar enuseplunk/plunk Resumen El endpoint de la API de Plunk POST /webhooks/sns obtiene un SubscribeURL proporcionado por el atacante sin verificar la firma criptográfica de AWS SNS. Un atacante no autenticado puede forzar al...

CVE-2026-92720

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...

CVE-2026-92720 Kubero through 3.1.1 Unauthenticated Notifications API Access

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...

EUVD-2026-80903

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...

CVE-2026-92720 Kubero through 3.1.1 Unauthenticated Notifications API Access

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...

CVE-2026-92720 Kubero through 3.1.1 Unauthenticated Notifications API Access

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...

CVE-2026-92720

Kubero through 3.1.1 fails to apply authentication guards to its notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials, register malicious webhooks to intercept pipeline events, or delete existing config...

CVE-2026-92602

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses...

CVE-2026-54167

A flaw was found in Pipelines-as-Code. The GitHub App provider incorrectly processes webhook events by accepting an untrusted X-GitHub-Enterprise-Host header as the API host before validating the webhook signature. An unauthenticated attacker can exploit this by sending a specially crafted webhoo...

SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit

= doi.org/10.5281/zenodo.18278825 = orcid.org/0009-0007-7728-256X RECONSTRUCTIONANALYSIS CVE-2026-21858: Ni8mare - n8n RCE Full Chain Exploit 1. Executive Summary & Overview This document presents a deterministic technical reconstruction analysis of the CVE-2026-21858 vulnerability, internally...

EUVD-2026-80860

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses...

CVE-2026-92602

TDuck survey form through version 5.3 is affected by a Server-Side Request Forgery vulnerability in the WebhookConfigController . The root cause is a failure to validate webhook URLs or verify form ownership, allowing authenticated attackers to attach webhooks to other users' forms and exfiltrate...

EUVD-2026-66389

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside...

CVE-2026-92139

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...

EUVD-2026-80764

Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint...

CVE-2026-92140

The Jenkins Gitee Plugin (versions 1301.v8957053c7902 and earlier) fails to escape the sender name from Gitee push webhook payloads when rendering build causes. This results in a stored cross-site scripting (XSS) vulnerability exploitable by any attacker able to trigger builds via the plugin's we...

CVE-2026-92140

Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint...

CVE-2026-92139

The Jenkins Bitbucket Push and Pull Request Plugin (versions 4.0.1 and earlier) is affected by a Server-Side Request Forgery (SSRF) vulnerability in its webhook endpoint (/bitbucket-hook/). The plugin trusts URL values supplied in the webhook payload and uses its configured Bitbucket credentials ...