4307 matches found
VulnCheck KEV: CVE-2026-31816
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any...
GHSA-H524-452V-82P9 vulnerabilities
Vulnerabilities for packages: apisix-ingress-controller, crossplane-provider-azure-authorization, libnvidia-container, kube-bench, cluster-api, kiali, crossplane-provider-aws-kms, rook, hubble-ui, crossplane-provider-aws-sns, cert-manager, kube-fluentd-operator, kube-state-metrics, crossplane,...
CVE-2026-42504 vulnerabilities
Vulnerabilities for packages: apisix-ingress-controller, crossplane-provider-azure-authorization, libnvidia-container, kube-bench, cluster-api, kiali, crossplane-provider-aws-kms, rook, hubble-ui, crossplane-provider-aws-sns, cert-manager, kube-fluentd-operator, kube-state-metrics, crossplane,...
GHSA-H3GM-Q7M7-MP28 vulnerabilities
Vulnerabilities for packages: apisix-ingress-controller, crossplane-provider-azure-authorization, libnvidia-container, kube-bench, cluster-api, neuvector-dbgen, docker-machine-driver-linode, kiali, crossplane-provider-aws-kms, sftpgo-plugin-auth, lazydocker, rook, hubble-ui, controller-gen,...
CVE-2026-27145 vulnerabilities
Vulnerabilities for packages: apisix-ingress-controller, crossplane-provider-azure-authorization, libnvidia-container, kube-bench, cluster-api, neuvector-dbgen, docker-machine-driver-linode, kiali, crossplane-provider-aws-kms, sftpgo-plugin-auth, lazydocker, rook, hubble-ui, controller-gen,...
CVE-2026-42507 vulnerabilities
Vulnerabilities for packages: apisix-ingress-controller, crossplane-provider-azure-authorization, libnvidia-container, kube-bench, cluster-api, neuvector-dbgen, docker-machine-driver-linode, kiali, crossplane-provider-aws-kms, sftpgo-plugin-auth, lazydocker, rook, hubble-ui, controller-gen,...
GHSA-4279-Q6MJ-392R vulnerabilities
Vulnerabilities for packages: apisix-ingress-controller, crossplane-provider-azure-authorization, libnvidia-container, kube-bench, cluster-api, neuvector-dbgen, docker-machine-driver-linode, kiali, crossplane-provider-aws-kms, sftpgo-plugin-auth, lazydocker, rook, hubble-ui, controller-gen,...
CVE-2026-42504 vulnerabilities
Vulnerabilities for packages: aws-iam-authenticator-fips, crossplane-provider-aws-directconnect-fips, commercial-chainloop-cli, kubevela-fips, helm, consul-fips, polaris, kubernetes-event-exporter, etcd, flyte, kubernetes-replicator-fips, helm-fips, backup-restore-operator-fips,...
GHSA-H524-452V-82P9 vulnerabilities
Vulnerabilities for packages: aws-iam-authenticator-fips, crossplane-provider-aws-directconnect-fips, commercial-chainloop-cli, kubevela-fips, helm, consul-fips, polaris, kubernetes-event-exporter, etcd, flyte, kubernetes-replicator-fips, helm-fips, backup-restore-operator-fips,...
GHSA-H3GM-Q7M7-MP28 vulnerabilities
Vulnerabilities for packages: terraform-provider-azuread-fips, aws-iam-authenticator-fips, crossplane-provider-aws-directconnect-fips, goreleaser, docker-credential-acr-env-fips, commercial-chainloop-cli, azurefile-csi-fips, kubevela-fips, helm, consul-fips, polaris, cloudprober-fips,...
CVE-2026-42507 vulnerabilities
Vulnerabilities for packages: terraform-provider-azuread-fips, aws-iam-authenticator-fips, crossplane-provider-aws-directconnect-fips, goreleaser, docker-credential-acr-env-fips, commercial-chainloop-cli, azurefile-csi-fips, kubevela-fips, helm, consul-fips, polaris, cloudprober-fips,...
CVE-2026-27145 vulnerabilities
Vulnerabilities for packages: terraform-provider-azuread-fips, aws-iam-authenticator-fips, crossplane-provider-aws-directconnect-fips, goreleaser, docker-credential-acr-env-fips, commercial-chainloop-cli, azurefile-csi-fips, kubevela-fips, helm, consul-fips, polaris, cloudprober-fips,...
GHSA-4279-Q6MJ-392R vulnerabilities
Vulnerabilities for packages: terraform-provider-azuread-fips, aws-iam-authenticator-fips, crossplane-provider-aws-directconnect-fips, goreleaser, docker-credential-acr-env-fips, commercial-chainloop-cli, azurefile-csi-fips, kubevela-fips, helm, consul-fips, polaris, cloudprober-fips,...
PT-2026-46853
Summary plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance without...
CVE-2026-10273
A vulnerability was found in php-censor up to 2.1.6. This affects an unknown function of the file src/Model/Build/GitBuild.php of the component Webhook Endpoint. Performing a manipulation of the argument commitId results in os command injection. The attack can be initiated remotely. The exploit h...
CVE-2026-10617
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possibl...
CVE-2026-10617 nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possibl...
CVE-2026-10617 nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possibl...
CVE-2026-10617
The CVE-2026-10617 entry describes a vulnerability in nextlevelbuilder GoClaw up to version 3.11.3, affecting the resolveAuth function in internal/http/auth.go of the Webhook Verification Handler. The issue results from a manipulation that leads to missing authentication, enabling remote exploita...
EUVD-2026-34009
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possibl...