Lucene search
+L

5622 matches found

EUVD
EUVD
•added 2026/07/17 7:06 p.m.•16 views

EUVD-2026-45272

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False which is the default...

9.8CVSS6.1AI score0.01041EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/07/17 7:06 p.m.•14 views

CVE-2026-8505 Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False which is the default...

9.8CVSS6.1AI score0.01041EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/07/17 7:06 p.m.•52 views

CVE-2026-8505 Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False which is the default...

9.8CVSS0.01041EPSS
SaveExploits0References1
attackerkb
attackerkb
•added 2026/07/17 7:06 p.m.•14 views

CVE-2026-8505

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False which is the default...

9.8CVSS6.1AI score0.01041EPSS
SaveExploits0References2Affected Software1
OSV
OSV
•added 2026/07/17 6:14 p.m.•22 views

GHSA-CWXQ-RC9X-2JVV Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

Summary The Kubernetes admission webhook handler reads the entire request body using io.ReadAllr.Body without any size limit. Any client that can reach the webhook port within the cluster can send a multi-GB payload, causing the skipper process to exhaust memory and be OOM-killed. This disrupts a...

4.3CVSS5.5AI score0.00298EPSS
SaveExploits0References3
Github Security Blog
Github Security Blog
•added 2026/07/17 6:14 p.m.•24 views

Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

Summary The Kubernetes admission webhook handler reads the entire request body using io.ReadAllr.Body without any size limit. Any client that can reach the webhook port within the cluster can send a multi-GB payload, causing the skipper process to exhaust memory and be OOM-killed. This disrupts a...

4.3CVSS5.5AI score0.00298EPSS
SaveExploits0References3Affected Software1
NCSC
NCSC
•added 2026/07/17 2:31 p.m.•77 views

Vulnerabilities handled in the n8n workflow automation platform

n8n has identified several vulnerabilities in its workflow automation platform, particularly in versions 2.10.1, 2.9.3, 1.123.22, and other related releases. These vulnerabilities affect various components of n8n, including Form nodes, Python Code nodes, JavaScript Task Runner sandboxes, Merge...

9.9CVSS8.8AI score0.01573EPSS
SaveExploits2References14
NVD
NVD
•added 2026/07/17 2:18 a.m.•32 views

CVE-2026-62234

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...

8.4CVSS0.00395EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
•added 2026/07/17 12:07 a.m.•14 views

CVE-2026-62234 Grav < 2.0.4 SSRF via Unrestricted cURL Protocols

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...

8.4CVSS5.3AI score0.00395EPSS
SaveExploits0References2
OSV
OSV
•added 2026/07/17 12:07 a.m.•21 views

CVE-2026-62234 Grav < 2.0.4 SSRF via Unrestricted cURL Protocols

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...

8.4CVSS5.2AI score0.0045EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/07/17 12:07 a.m.•24 views

EUVD-2026-45080

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...

8.4CVSS6.1AI score0.00395EPSS
SaveExploits0References2
CVE
CVE
•added 2026/07/17 12:07 a.m.•35 views

CVE-2026-62234

Grav 2.x prior to 2.0.4 contains an SSRF vulnerability in webhook dispatch where authenticated users with api.webhooks.write can create webhooks using file://, dict://, or gopher:// protocols. This unrestricted protocol handling can be leveraged to read local files, access process information, or...

8.4CVSS6.1AI score0.00395EPSS
SaveExploits0References2
attackerkb
attackerkb
•added 2026/07/17 12:07 a.m.•15 views

CVE-2026-62234

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...

8.4CVSS6.1AI score0.00395EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/07/17 12:00 a.m.•25 views

PT-2026-60866

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description A flaw in the webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK AUTH...

9.8CVSS6.4AI score0.01041EPSS
SaveExploits0References6
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/07/17 12:00 a.m.•1 views

CVE-2026-62234: Server-Side Request Forgery (SSRF)

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...

8.4CVSS5.7AI score0.00395EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/07/17 12:00 a.m.•27 views

PT-2026-60644

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4 Description Authenticated users with api.webhooks.write permission can create webhooks using unrestricted cURL protocols such as file://, dict://, or gopher://. This allows attackers to trigger webhook events to re...

8.4CVSS5.9AI score0.00395EPSS
SaveExploits0References8
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/07/17 12:00 a.m.•0 views

CVE-2026-8505: Missing Authentication for Critical Function

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False which is the default...

9.8CVSS6.4AI score0.01041EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/07/17 12:00 a.m.•35 views

PT-2026-60893

Name of the Vulnerable Software and Affected Versions Skipper affected versions not specified Description The Kubernetes admission webhook handler reads the entire request body without a size limit. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a...

4.3CVSS5.3AI score0.00298EPSS
SaveExploits0
NVD
NVD
•added 2026/07/16 9:17 p.m.•24 views

CVE-2026-33731

WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook handler at plugin/AuthorizeNet/webhook.php contains a signature verification bypass that allows an attacker to forge webhook requests with arbitrary payment amounts and target user IDs. By supplying...

6.5CVSS0.00205EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/07/16 8:46 p.m.•56 views

CVE-2026-33731 AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data

WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook handler at plugin/AuthorizeNet/webhook.php contains a signature verification bypass that allows an attacker to forge webhook requests with arbitrary payment amounts and target user IDs. By supplying...

6.5CVSS0.00205EPSS
SaveExploits0References2
Rows per page
Query Builder