6399 matches found
CVE-2026-11430
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...
CVE-2026-11430
Grav CMS’s scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a conditional short-circuit skips token validation, allowing an unauthenticated remote attacker who can reach POST /scheduler/we...
CVE-2026-11430 Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...
CVE-2026-11430 Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...
EUVD-2026-54601
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...
CVE-2026-11430 Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...
MAL-2026-13620 Malicious code in @catamania/front-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49b66b93df02350bdf848ac2cff8c6a563ac36c1828480891381875453be67f5 The package's postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname, os.userInfo username, process.cwd...
Malicious code in @catamania/front-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49b66b93df02350bdf848ac2cff8c6a563ac36c1828480891381875453be67f5 The package's postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname, os.userInfo username, process.cwd...
PT-2026-69111
Name of the Vulnerable Software and Affected Versions Grav CMS scheduler-webhook plugin affected versions not specified Description An authentication bypass exists in the webhook token check of the scheduler-webhook plugin. When the webhook feature is enabled but no webhookToken is configured, th...
CVE-2026-11430: Incorrect Implementation of Authentication Algorithm
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...
CVE-2026-15732
A Server-Side Request Forgery SSFR vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses...
CVE-2026-15732
A Server-Side Request Forgery (SSRF) vulnerability exists in WGDashboard version 4.2.3 and earlier . The flaw resides in the webhook functionality , which allows authenticated attackers to perform arbitrary HTTP requests and retrieve the resulting responses. The documents do not provide specific ...
CVE-2026-15732 WGDashboard Server-Side Request Forgery Vulnerability
A Server-Side Request Forgery SSFR vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses...
CVE-2026-70646
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...
CVE-2026-70646
CVE-2026-70646 concerns the aiosend Crypto Pay API client. Before version 3.0.7, WebhookHandler.feed_update() deserializes the entire request body prior to HMAC verification, enabling an unauthenticated attacker to trigger expensive JSON parsing and cause CPU/memory exhaustion (pre-auth DoS). The...
CVE-2026-70646
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...
CVE-2026-70646 aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...
CVE-2026-70646 aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...
EUVD-2026-53920
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...
CVE-2026-70646 aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...