CVE-2026-51583

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) . The vulnerability is located in the Webhook validation mechanism within internal/webhook/validate.go, which allows an attacker to set a webhook target to an internal address...

CVE-2026-51583

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...

PT-2026-70142

Name of the Vulnerable Software and Affected Versions Apioo Fusio version 8.8.3 Description An authenticated user with the consumer role can trigger server-side request forgery by registering a webhook URL that points to an internal host. The webhook registration endpoint validates URL syntax usi...

Malicious code in ethereum-vault-connector (npm)

ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector EVC protocol. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js |...

CVE-2026-51583

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...

PT-2026-70151

Name of the Vulnerable Software and Affected Versions OpenShift Console affected versions not specified Description An authenticated Server-Side Request Forgery SSRF flaw exists in the OpenShift Console Dev Console webhook helpers. The system fetches user-supplied target URLs server-side without...

Malicious code in @aerodrome-finance/contracts (npm)

@aerodrome-finance/contracts is a malicious npm package that impersonates Aerodrome Finance. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the code...

Malicious code in boring-vault (npm)

boring-vault is a malicious npm package that impersonates the BoringVault smart-contract framework. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the co...

CVE-2026-73087: Server-Side Request Forgery (SSRF)

Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible...

CVE-2026-48494: Authorization Bypass Through User-Controlled Key

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign preview phone number tied to another preview...

EUVD-2026-56176

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...

PT-2026-70222

Name of the Vulnerable Software and Affected Versions AutoGPT versions prior to 0.6.70 Description AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. A path confusion issue exists in the webhook ingress generic route within...

PT-2026-70785

Name of the Vulnerable Software and Affected Versions Dozzle versions 10.5.2 through 10.6.14 Description The isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, utilized by safeDialContext for webhook notification URLs, fails to inspect IPv4 addresses embedded within 6to4, NAT6...

CVE-2026-72761 Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is_global check) in vulnerability-lookup

The webhook URL validator in website/notifications/webhooks.py uses ip.isglobal to reject non-public addresses after DNS resolution. IPv6 transition addresses NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32 are classified as globally routable by IANA, so isglobal returns True even when...

CVE-2026-72761 Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is_global check) in vulnerability-lookup

The webhook URL validator in website/notifications/webhooks.py uses ip.isglobal to reject non-public addresses after DNS resolution. IPv6 transition addresses NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32 are classified as globally routable by IANA, so isglobal returns True even when...

EUVD-2026-55637

The webhook URL validator in website/notifications/webhooks.py uses ip.isglobal to reject non-public addresses after DNS resolution. IPv6 transition addresses NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32 are classified as globally routable by IANA, so isglobal returns True even when...

CVE-2026-72761

The CVE affects the webhook URL validator in website/notifications/webhooks.py, which uses ip.is_global after DNS resolution. IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32) are categorized as globally routable by IANA, causing is_global to return True even w...

PYSEC-2026-3626 aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

Summary WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Severity...

aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

SummaryWebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. SeverityHig...

EUVD-2026-54721

Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at GET /api/v1/subscription/stripe/callback?checkoutSessionId= retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the...