Lucene search
+L

5259 matches found

CVE
CVE
•added 2026/09/04 2:32 p.m.•19 views

CVE-2026-85621

LobeChat (LobeHub) 2.2.1 has an improper webhook signature verification flaw in its QQ and Feishu adapters . The webhook route (/api/agent/webhooks/:platform) is unauthenticated by design and delegates verification to each adapter. The QQ adapter performs no Ed25519 signature verification on disp...

6.9CVSS5.5AI score0.00201EPSS
SaveExploits0References5
OSV
OSV
•added 2026/09/04 2:32 p.m.•10 views

CVE-2026-85621 LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu

LobeChat LobeHub 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route /api/agent/webhooks/:platform is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verificatio...

6.9CVSS5.8AI score
SaveExploits0References7
Cvelist
Cvelist
•added 2026/09/04 2:32 p.m.•33 views

CVE-2026-85621 LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu

LobeChat LobeHub 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route /api/agent/webhooks/:platform is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verificatio...

6.9CVSS0.00201EPSS
SaveExploits0References5
CVE
CVE
•added 2026/09/04 12:00 a.m.•22 views

CVE-2026-71626

An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information by interacting with the StoreWebhookRequest.php , UpdateWebhookRequest.php , and WebhookSingle.php components. While the specific root cause and exploitation methods are not detailed in the provided docume...

5.3AI score0.00535EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/04 12:00 a.m.•38 views

CVE-2026-71626

An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components...

0.00535EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2026/09/04 12:00 a.m.•17 views

PT-2026-85545

LobeChat LobeHub 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route /api/agent/webhooks/:platform is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verificatio...

6.9CVSS5.5AI score0.00201EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/09/04 12:00 a.m.•16 views

PT-2026-85560

xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhook worktool handler and exploit unvalidated media U...

9.3CVSS5.5AI score0.00695EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
•added 2026/09/04 12:00 a.m.•8 views

CVE-2026-71626

An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components...

5.8AI score0.00535EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/04 12:00 a.m.•10 views

EUVD-2026-71744

An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components...

5.3AI score0.00535EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2026/09/04 12:00 a.m.•15 views

PT-2026-86245

An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components...

5.3AI score0.00535EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/04 12:00 a.m.•16 views

PT-2026-86242

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allow private: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...

7.7CVSS5.3AI score0.00464EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/09/04 12:00 a.m.•10 views

PT-2026-85551

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

5.4CVSS5.3AI score0.00348EPSS
SaveExploits0References7
NVD
NVD
•added 2026/09/03 3:17 p.m.•9 views

CVE-2026-85179

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

8.5CVSS0.00401EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/09/03 2:12 p.m.•15 views

EUVD-2026-70483

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

8.5CVSS5.9AI score0.00401EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/09/03 2:12 p.m.•35 views

CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

8.5CVSS0.00401EPSS
SaveExploits0References5
OSV
OSV
•added 2026/09/03 2:12 p.m.•11 views

CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

8.4CVSS5.5AI score
SaveExploits0References7
Vulnrichment
Vulnrichment
•added 2026/09/03 2:12 p.m.•10 views

CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

8.5CVSS5.2AI score0.00401EPSS
SaveExploits0References5
CVE
CVE
•added 2026/09/03 2:12 p.m.•17 views

CVE-2026-85179

Label Studio versions through 1.23.0 are affected by a Server-Side Request Forgery (SSRF) vulnerability in the webhook functionality (specifically in webhooks/utils.py). The application fails to validate webhook URLs , allowing authenticated users to dispatch outbound requests to internal network...

8.5CVSS5.9AI score0.00401EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/03 1:05 p.m.•17 views

CVE-2026-3416

The API Publisher component previously used a non-cryptographic pseudorandom number generator PRNG to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables...

7.5CVSS0.00358EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/03 12:35 p.m.•65 views

CVE-2026-3416 Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads

The API Publisher component previously used a non-cryptographic pseudorandom number generator PRNG to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables...

5.9CVSS0.00358EPSS
SaveExploits0References1
Rows per page
Query Builder