GO-2024-2536 vulnerabilities

Vulnerabilities for packages: rancher-webhook...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: zitadel, cosmo-router, karma-fips, cosmo-router-fips, fluxcd-kustomize-mutating-webhook, kyverno, telegraf, fluxcd-kustomize-mutating-webhook-fips, karma...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: zitadel, cosmo-router, karma-fips, cosmo-router-fips, fluxcd-kustomize-mutating-webhook, kyverno, telegraf, fluxcd-kustomize-mutating-webhook-fips, karma...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: zitadel, cosmo-router, karma-fips, cosmo-router-fips, fluxcd-kustomize-mutating-webhook, kyverno, telegraf, fluxcd-kustomize-mutating-webhook-fips, karma...

GO-2024-3282 vulnerabilities

Vulnerabilities for packages: step-issuer, cert-manager-webhook-pdns-fips, cert-exporter-fips, cert-manager-cmctl, cert-manager-cmctl-fips, cert-manager-istio-csr, cert-manager-webhook-pdns, aws-privateca-issuer, step-issuer-fips, cert-exporter, aws-privateca-issuer-fips...

GO-2024-2428 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: telegraf, kyverno, fluxcd-kustomize-mutating-webhook, karma...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: telegraf, kyverno, fluxcd-kustomize-mutating-webhook, karma...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: telegraf, kyverno, fluxcd-kustomize-mutating-webhook, karma...

GO-2025-3465 vulnerabilities

Vulnerabilities for packages: kapp, yunikorn-k8shim, rancher-fleet, spark-operator, nodetaint, ip-masq-agent, aws-efs-csi-driver, kubernetes, argo-rollouts, kubernetes-csi-driver-hostpath, kubernetes-csi-driver-nfs, emissary, argocd-image-updater, kubernetes-dns-node-cache,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: cis-operator, cluster-api-helm-controller, nri-couchbase, spire-server, crossplane-provider-aws-sqs, gomplate, flux-image-reflector-controller, opa, libnvidia-container, temporal-server, octo-sts, fluent-bit-plugin-loki, ksops, vcluster, prometheus, azcopy,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: clickhouse-operator, nri-couchbase, spire-server, redis-operator, git-lfs, octo-sts, kine, ksops, scorecard, k3d, spire-controller-manager, azcopy, swagger, podinfo, nri-rabbitmq, rabbitmq-default-user-credential-updater, kyverno-policy-reporter-ui, dockerize,...

EUVD-2026-58502

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...

PT-2026-72128

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description An Insecure Direct Object Reference IDOR exists where a repository administrator can access notification configurations of other repositories by knowing or guessing the Universally Uniqu...

PT-2026-72130

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description A flaw exists in the Stripe billing webhook handler. An unauthenticated attacker can forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint. The system...

CVE-2026-74244: Improper Verification of Cryptographic Signature

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...

VulnCheck KEV: CVE-2026-45298

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy the documented quickstart, no DOZZLEAUTHPROVIDER set, POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that...

CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-72851

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...

CVE-2026-72851

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...