CVE-2026-103329: Improper Verification of Cryptographic Signature

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...

EUVD-2026-42896

PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF...

CVE-2026-103517 Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Webhook

The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying...

CVE-2026-103517

The Airwallex Online Payments Gateway WordPress plugin, in versions prior to 1.36.0 , is vulnerable to an unauthenticated payment bypass. The root cause is a failure to verify the authenticity of incoming payment notifications when no webhook secret is configured. This allows unauthenticated atta...

PT-2026-108713

Name of the Vulnerable Software and Affected Versions praisonai version 4.6.63 Description The Async Jobs API fails to enforce authentication by default, as the API-key middleware is only active when the PRAISONAI JOBS API KEY environment variable is set. This allows unauthenticated access to the...

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger

NPM: Ghost: Server-Side Request Forgery in Webhook Trigger vulnerability discovered by ? in WordPress Npm ghost versions = 1.18.0, 6.27.0...

GHSA-7C92-X8VG-4258 PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

AgentMail webhook mode accepts forged unsigned message.received events and invokes agents Summary praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches...

EUVD-2026-44642

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents...

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

AgentMail webhook mode accepts forged unsigned message.received events and invokes agents Summary praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches...

EUVD-2026-43177

PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing...

GHSA-QJ9C-59P6-8CGX PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

Summary PraisonAI's AgentMail bot, when run in webhook or hybrid mode, starts an aiohttp webhook server bound to 0.0.0.0 and processes inbound message.received events without verifying any signature/HMAC and without authentication. The sender address and message body are taken directly from the...

PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

Summary PraisonAI's AgentMail bot, when run in webhook or hybrid mode, starts an aiohttp webhook server bound to 0.0.0.0 and processes inbound message.received events without verifying any signature/HMAC and without authentication. The sender address and message body are taken directly from the...

CVE-2026-26287

A flaw was found in external-secrets. An issue during webhook generator initialization incorrectly clears the label enforcement setting, bypassing provider-side validation. An authenticated user with permissions to create webhook generators can target arbitrary secrets lacking the required label...

PT-2026-107649

Name of the Vulnerable Software and Affected Versions praisonai versions 4.5.128 through 4.6.62 Description The AgentMail webhook mode in praisonai exposes a public aiohttp endpoint that accepts message.received JSON payloads without verifying Svix webhook signatures. This allows an attacker to...

CVE-2026-26287

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

CVE-2026-26287 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

CVE-2026-26287

The External Secrets Operator is vulnerable to a label enforcement bypass in the webhook generator due to an incorrect initialization order. Specifically, the EnforceLabels flag is incorrectly cleared after being set, causing the provider-side check for the external-secrets.io/type=webhook label ...

CVE-2026-26287 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

EUVD-2026-93468

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

CVE-2026-26287 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...