6146 matches found
CVE-2026-25051 n8n Improper CSP Enforcement in Webhook Responses May Allow Stored XSS
n8n is an open source workflow automation platform. Prior to version 1.123.2, a Cross-Site Scripting XSS vulnerability has been identified in the handling of webhook responses and related HTTP endpoints. Under certain conditions, the Content Security Policy CSP sandbox protection intended to...
CVE-2026-25051
CVE-2026-25051 affects n8n (open source workflow automation). The issue is an XSS in the handling of webhook responses and related HTTP endpoints where CSP sandbox protection may not be applied under certain conditions. An authenticated user with permission to create/modify workflows could abuse ...
CVE-2026-25518 vulnerabilities
Vulnerabilities for packages: percona-server-mongodb-operator, cert-manager-webhook-pdns, cert-manager-istio-csr, cert-manager-csi-driver, opentelemetry-operator, step-issuer, mariadb-operator, aws-privateca-issuer, cert-manager-cmctl...
PT-2026-6105
Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.4 Description A GLPI administrator can perform Server-Side Request Forgery SSRF requests through the Webhook feature. This allows an attacker to potentially make requests on behalf of the server, accessing...
PT-2026-6260
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.2 Description n8n is a workflow automation platform. A Cross-Site Scripting XSS issue exists in the handling of webhook responses and related HTTP endpoints. The Content Security Policy CSP sandbox protection may no...
PT-2026-6391
Impact A Cross-site Scripting XSS vulnerability has been identified in the handling of webhook responses and related HTTP endpoints. Under certain conditions, the Content Security Policy CSP sandbox protection intended to isolate HTML responses may not be applied correctly. An authenticated user...
PT-2026-6071
Name of the Vulnerable Software and Affected Versions ZenTao versions through 21.7.6-85642 Description A server-side request forgery condition exists in ZenTao. The issue is located in the fetchHook function within the module/webhook/model.php file of the Webhook Module component. This manipulati...
n8n 跨站脚本漏洞
n8n is an open-source, scalable workflow automation tool developed by n8n. Versions of n8n prior to 1.123.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from improper handling of Webhook responses and HTTP endpoints, potentially leading to cross-site scripting attack...
CVE-2026-22247: Server-Side Request Forgery (SSRF)
GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5...
Nature Easy Soft Network Technology ZenTao 代码问题漏洞
Nature Easy Soft Network Technology ZenTao is an open-source project management software developed by Nature Easy Soft Network Technology. This software includes functions such as product management, project management, quality management, and document management. The version 21.7.6-85642 and...
GLPI 代码问题漏洞
GLPI is an open-source IT and asset management software developed by GLPI. This software provides a comprehensive IT resource management interface, allowing you to create databases to manage various IT assets such as computers, monitors, servers, printers, network devices, telephones, and even...
CVE-2026-25051: Improper Neutralization of Input During Web Page Generation
n8n is an open source workflow automation platform. Prior to version 1.123.2, a Cross-Site Scripting XSS vulnerability has been identified in the handling of webhook responses and related HTTP endpoints. Under certain conditions, the Content Security Policy CSP sandbox protection intended to...
CVE-2026-1884: Server-Side Request Forgery (SSRF)
A weakness has been identified in ZenTao up to 21.7.6-85642. The impacted element is the function fetchHook of the file module/webhook/model.php of the component Webhook Module. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made...
GHSA-GX3X-VQ4P-MHHV vulnerabilities
Vulnerabilities for packages: percona-server-mongodb-operator, cert-manager-webhook-pdns, cert-manager-istio-csr, cert-manager-csi-driver, opentelemetry-operator, step-issuer, mariadb-operator, aws-privateca-issuer, cert-manager-cmctl...
GHSA-GX3X-VQ4P-MHHV vulnerabilities
Vulnerabilities for packages: step-issuer-fips, cert-manager-google-cas-issuer, cert-manager-openshift-routes-fips, cert-manager-csi-driver-fips, gitlab-operator, cert-manager-google-cas-issuer-fips, cert-manager-openshift-routes, cert-manager-csi-driver, opentelemetry-operator-fips,...
Improper Access Control.
Weblate is vulnerable to improper access control. The vulnerability is due to insufficient validation of webhook payloads, which allows an attacker to craft malicious webhook requests and trigger unauthorized repository updates across multiple repositories...
BIT-DISCOURSE-2026-24742 Discourse staff action logs expose sensitive information to moderators
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and...
CLEANSTART-2026-HV28992 Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3
Multiple security vulnerabilities affect the cert-manager-webhook-pdns-fips package. Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3. See references for individual vulnerability details...
CLEANSTART-2026-QW16951 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process
Multiple security vulnerabilities affect the cert-manager-webhook-pdns-fips package. SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process. See references for individual vulnerability details...