MAL-2026-12065 Malicious code in greatcall-customers-commandapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2e378b27f75da210578cf8a4102023d3cbf2ab7e96a97267d73c6ffa15500c9 [email protected] is a dependency-confusion attack package. package.json self-describes as "Dependency confusion PoC" and declare...

Malicious code in add-two-numbers-x7q9m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 550dfc48a74577d95e53fc64cc296a9cc59a5940edb6eac3f191f41376350635 The package advertises itself as a trivial 'add two numbers' utility but its preinstall lifecycle script enumerates the installer's Desktop directory...

MAL-2026-12032 Malicious code in add-two-numbers-x7q9m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 550dfc48a74577d95e53fc64cc296a9cc59a5940edb6eac3f191f41376350635 The package advertises itself as a trivial 'add two numbers' utility but its preinstall lifecycle script enumerates the installer's Desktop directory...

CVE-2026-71272: Time-of-check Time-of-use (TOCTOU) Race Condition

Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...

PT-2026-68272

Name of the Vulnerable Software and Affected Versions Jenkins Webhook Secret Credentials Provider Plugin versions prior to 16.v0cfa f0215cf5 Description The plugin fails to use a constant-time comparison function when verifying if the provided webhook bearer token matches the expected one. This...

PT-2026-68144

Name of the Vulnerable Software and Affected Versions Memos affected versions not specified Description Insufficient validation of webhook URLs occurs in the isReservedIP function located in internal/webhook/validate.go. The function checks candidate IPs against a reserved CIDR list but omits the...

CVE-2026-71271: Server-Side Request Forgery (SSRF)

Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does...

CVE-2026-70437: Observable Timing Discrepancy

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...

Non-constant time webhook bearer token comparison in webhook-secret-credentials-provider

webhook-secret-credentials-provider 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal. This could potentially allow attackers to use statistical methods to obtain a valid webhook bearer toke...

Jenkins plugins Multiple Vulnerabilities (2026-08-05)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2... CVE-2026-70426 - Jenkins 2.575 and...

PYSEC-2026-3614 pytonapi has a Webhook Custom Path Authentication Bypass

Webhook Custom Path Authentication Bypass in pytonapi Summary TonapiWebhookDispatcher in pytonapi 2.2.0 fails to validate the Authorization header when a webhook handler is registered with the documented path= argument. During setup, bearer tokens are stored only under the default suffix paths...

PYSEC-2026-3598 Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Summary The channel members endpoint serializes and returns full user models for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material settings.ui.toolServers.key, which is not...

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

SummaryThe channel members endpoint serializes and returns full user models for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material settings.ui.toolServers.key, which is not...

pytonapi has a Webhook Custom Path Authentication Bypass

Webhook Custom Path Authentication Bypass in pytonapi SummaryTonapiWebhookDispatcher in pytonapi 2.2.0 fails to validate the Authorization header when a webhook handler is registered with the documented path= argument. During setup, bearer tokens are stored only under the default suffix paths e.g...

PYSEC-2026-3576 hermes-agent has an Uncontrolled Resource Consumption issue

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the function handlewebhookrequest of the file gateway/platforms/feishu.py of the component Webhook Endpoint. Such manipulation leads to resource consumption. The attack can be...

hermes-agent has an Uncontrolled Resource Consumption issue

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the function handlewebhookrequest of the file gateway/platforms/feishu.py of the component Webhook Endpoint. Such manipulation leads to resource consumption. The attack can be...

📄 OpenClaw Dashboard Cross Site Scripting

OpenClaw Dashboard suffers from a persistent cross site scripting vulnerability via the lastMessage Session Field. Security Advisory: Stored Cross-Site Scripting Via Agent Messages Leading To Session Token Theft openclaw-dashboard Title: OpenClaw Dashboard Stored XSS via lastMessage Session Field...

Denial Of Service (DoS)

Capsule is vulnerable to Denial of Service DoS. The vulnerability is due to insufficient validation of the ForbiddenLabels.Regex and ForbiddenAnnotations.Regex fields in the configuration admission webhook, which allows an attacker with Cluster Administrator privileges to store a malformed regula...

CVE-2026-15006

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...

CVE-2026-54725

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...