CVE-2026-74244 Quay: stripe webhook accepts forged events without signature verification in quay

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...

CVE-2026-74244

Red Hat Quay is affected by a missing Stripe-Signature header validation in its billing webhook handler at the /webhooks/stripe endpoint. An unauthenticated attacker can send crafted JSON requests to forge billing events, resulting in the unauthorized reset of a namespace build quota to its maxim...

CVE-2026-74242

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability al...

CVE-2026-74242 Quay: repository notification uuid idor in quay api

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability al...

Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

GHSA-5FPJ-28RV-84R7 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

GO-2025-3522 vulnerabilities

Vulnerabilities for packages: rancher-webhook-fips, rancher-agent...

GO-2024-2536 vulnerabilities

Vulnerabilities for packages: rancher-webhook...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: cosmo-router, karma, cosmo-router-fips, fluxcd-kustomize-mutating-webhook-fips, kyverno, fluxcd-kustomize-mutating-webhook, commercial-kyverno, telegraf, zitadel, karma-fips...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: cosmo-router, karma, cosmo-router-fips, fluxcd-kustomize-mutating-webhook-fips, kyverno, fluxcd-kustomize-mutating-webhook, commercial-kyverno, telegraf, zitadel, karma-fips...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: cosmo-router, karma, cosmo-router-fips, fluxcd-kustomize-mutating-webhook-fips, kyverno, fluxcd-kustomize-mutating-webhook, commercial-kyverno, telegraf, zitadel, karma-fips...

GO-2024-3282 vulnerabilities

Vulnerabilities for packages: step-issuer-fips, cert-manager-cmctl-fips, cert-manager-istio-csr, cert-manager-cmctl, cert-exporter, step-issuer, cert-manager-webhook-pdns, cert-manager-webhook-pdns-fips, aws-privateca-issuer-fips, aws-privateca-issuer, cert-exporter-fips...

GO-2024-2428 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, kyverno, karma, telegraf...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, kyverno, karma, telegraf...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, kyverno, karma, telegraf...

GO-2025-3465 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, rancher-fleet, ip-masq-agent, emissary, nodetaint, kubernetes, kubernetes-csi-driver-nfs, spark-operator, argocd-image-updater, vcluster, local-static-provisioner, aws-efs-csi-driver, kapp, yunikorn-k8shim, argo-rollouts,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: opentofu, kubo, cluster-api, kube-fluentd-operator, azure-workload-identity-webhook, cloud-sql-proxy, dask-gateway, chisel, amazon-k8s-cni, continuity, istio, crossplane-provider-aws-lambda, cluster-api-helm-controller, nfs-subdir-external-provisioner, grafana-mimir,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, cluster-api-gcp-controller, kubo, opentofu, azure-workload-identity-webhook, dask-gateway, redka, chisel, osv-scanner, nfs-subdir-external-provisioner, crossplane-provider-aws-lambda, azure-service-operator,...

EUVD-2026-58502

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...