CVE-2026-72598 Apioo Fusio - Server-Side Request Forgery

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

CVE-2026-72598

CVE-2026-72598 affects Apioo Fusio 8.8.3. A server‑side request forgery occurs when authenticated consumer‑role users register a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax with FILTER_VALIDATE_URL but imposes no IP or host denylist. When the r...

Malicious code in @aerodrome-finance/slipstream (npm)

@aerodrome-finance/slipstream is a malicious npm package that impersonates Aerodrome Finance's Slipstream concentrated-liquidity AMM. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall ru...

PT-2026-70785

Name of the Vulnerable Software and Affected Versions Dozzle versions 10.5.2 through 10.6.14 Description The isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, utilized by safeDialContext for webhook notification URLs, fails to inspect IPv4 addresses embedded within 6to4, NAT6...

CVE-2026-48494: Authorization Bypass Through User-Controlled Key

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign preview phone number tied to another preview...

CVE-2026-73087: Server-Side Request Forgery (SSRF)

Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible...

PT-2026-70256

TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings...

CVE-2026-72922: Improper Authentication

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, AutoGPT's autogptplatform/backend/backend/api/features/integrations/router.py webhookingressgeneric route selected getwebhookmanagerprovider from the untrust...

CVE-2026-47704: Authorization Bypass Through User-Controlled Key

TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign live resultId. The webhook resume handler...

CVE-2026-50236: Server-Side Request Forgery (SSRF)

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-72598: Server-Side Request Forgery (SSRF)

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

PT-2026-70222

Name of the Vulnerable Software and Affected Versions AutoGPT versions prior to 0.6.70 Description AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. A path confusion issue exists in the webhook ingress generic route within...

PT-2026-70142

Name of the Vulnerable Software and Affected Versions Apioo Fusio version 8.8.3 Description An authenticated user with the consumer role can trigger server-side request forgery by registering a webhook URL that points to an internal host. The webhook registration endpoint validates URL syntax usi...

PT-2026-70255

TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign live resultId. The webhook resume handler...

CVE-2026-51583: Server-Side Request Forgery (SSRF)

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...

PT-2026-70208

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...

EUVD-2026-56176

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...

CVE-2026-51583

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...

CVE-2026-51583

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...

CVE-2026-51583

The usememos application, through version v0.30.0 , is vulnerable to Server-Side Request Forgery (SSRF) . This issue exists in the Webhook validation mechanism located at internal/webhook/validate.go. A remote authenticated attacker can exploit this by setting a webhook target to an internal addr...