4347 matches found
GHSA-447V-2QG4-H8HC vulnerabilities
Vulnerabilities for packages: kwok, spqr, cfssl, hydra, local-path-provisioner, ferretdb, mongodb-kubernetes-operator, petname, kubescape-operator, aws-sigv4-proxy, runc, spicedb-operator, kubecolor, cluster-api-provider-vsphere, terraform-provider-time, vertical-pod-autoscaler, nova, cri-tools,...
CVE-2025-58188 vulnerabilities
Vulnerabilities for packages: kwok, spqr, cfssl, hydra, local-path-provisioner, ferretdb, mongodb-kubernetes-operator, petname, kubescape-operator, aws-sigv4-proxy, runc, spicedb-operator, kubecolor, cluster-api-provider-vsphere, terraform-provider-time, vertical-pod-autoscaler, nova, cri-tools,...
CVE-2025-58188 vulnerabilities
Vulnerabilities for packages: fluent-operator-fips, promxy-fips, rancher-webhook-fips, kbld-fips, etcd, age-fips, knative-eventing-fips, azurefile-csi, ucd, kustomize-fips, gostatsd, prometheus-pushgateway, syncthing, kube-state-metrics, crane, harbor-fips, tofu-controller, boring-registry-fips,...
GHSA-CXQ7-XW9V-RCV3 vulnerabilities
Vulnerabilities for packages: fluent-operator-fips, promxy-fips, rancher-webhook-fips, kbld-fips, etcd, age-fips, knative-eventing-fips, azurefile-csi, ucd, kustomize-fips, gostatsd, prometheus-pushgateway, syncthing, kube-state-metrics, crane, harbor-fips, tofu-controller, boring-registry-fips,...
GHSA-9GCR-GP5F-JW27 vulnerabilities
Vulnerabilities for packages: fluent-operator-fips, promxy-fips, rancher-webhook-fips, kbld-fips, etcd, age-fips, knative-eventing-fips, azurefile-csi, ucd, kustomize-fips, gostatsd, prometheus-pushgateway, syncthing, kube-state-metrics, crane, harbor-fips, tofu-controller, boring-registry-fips,...
CVE-2025-58189 vulnerabilities
Vulnerabilities for packages: fluent-operator-fips, promxy-fips, rancher-webhook-fips, kbld-fips, etcd, age-fips, knative-eventing-fips, azurefile-csi, ucd, kustomize-fips, gostatsd, prometheus-pushgateway, syncthing, kube-state-metrics, crane, harbor-fips, tofu-controller, boring-registry-fips,...
Exploit for Server-Side Request Forgery in Rocket.Chat
CVE-2024-39713: Rocket.Chat SSRF PoC Description A Server...
CVE-2025-11564
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it...
CVE-2025-11564
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it...
EUVD-2025-35913
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it...
CVE-2025-11564 Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it...
PT-2025-43706
Name of the Vulnerable Software and Affected Versions Tutor LMS versions up to and including 3.8.3 Description The Tutor LMS plugin for WordPress is susceptible to unauthorized data modification. This occurs because of a missing capability check when verifying webhook signatures within the...
SUSE CVE-2025-61926
Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar's Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary an...
GO-2025-3993 Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd...
GO-2025-3996 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd...
GO-2025-3995 Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd...
GO-2025-4018 Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret in github.com/ossf/allstar
Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret in github.com/ossf/allstar...
GHSA-VFFH-C9PQ-4CRH Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read
Summary In some Notification types e.g., Webhook, Telegram, the send function allows user-controlled renderTemplate input. This leads to a Server-side Template Injection SSTI vulnerability that can be exploited to read arbitrary files from the server. Details The root cause is how Uptime Kuma...
Malicious code in saintone (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d762a42d55901a472c7070197cef989428ecb0140acfe02c72d719d74b430436 Code downloads and starts an executable widely recognized as malware, then sends some results to a Telegram webhook. --- Category: MALICIOUS - The campaign has...
MAL-2025-191862 Malicious code in saintone (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d762a42d55901a472c7070197cef989428ecb0140acfe02c72d719d74b430436 Code downloads and starts an executable widely recognized as malware, then sends some results to a Telegram webhook. --- Category: MALICIOUS - The campaign has...