Lucene search
+L

4471 matches found

CVE
CVE
added 2026/08/10 2:33 p.m.38 views

CVE-2026-72761

The CVE affects the webhook URL validator in website/notifications/webhooks.py, which uses ip.is_global after DNS resolution. IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32) are categorized as globally routable by IANA, causing is_global to return True even w...

6.9CVSS5.3AI score0.00362EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/10 2:33 p.m.13 views

EUVD-2026-55637

The webhook URL validator in website/notifications/webhooks.py uses ip.isglobal to reject non-public addresses after DNS resolution. IPv6 transition addresses NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32 are classified as globally routable by IANA, so isglobal returns True even when...

6.9CVSS5.3AI score0.00362EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/07 7:17 p.m.9 views

CVE-2026-11430

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...

7.3CVSS0.00506EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/08/07 7:2 p.m.12 views

CVE-2026-11430 Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...

7.3CVSS5.9AI score0.00506EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/07 7:2 p.m.22 views

EUVD-2026-54601

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...

7.3CVSS5.9AI score0.00506EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/07 7:2 p.m.34 views

CVE-2026-11430 Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...

7.3CVSS0.00506EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/07 7:2 p.m.9 views

CVE-2026-11430 Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...

6.9CVSS5.9AI score0.00424EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/08/07 7:2 p.m.10 views

CVE-2026-11430

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...

7.3CVSS5.9AI score0.00506EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/07 7:2 p.m.43 views

CVE-2026-11430

Grav CMS’s scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a conditional short-circuit skips token validation, allowing an unauthenticated remote attacker who can reach POST /scheduler/we...

7.3CVSS5.9AI score0.00506EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/06 10:16 p.m.8 views

CVE-2026-15732

A Server-Side Request Forgery SSFR vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses...

9.8CVSS0.00381EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/06 7:59 p.m.5 views

CVE-2026-15732 WGDashboard Server-Side Request Forgery Vulnerability

A Server-Side Request Forgery SSFR vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses...

9.8CVSS5.5AI score
SaveExploits0References4
CVE
CVE
added 2026/08/06 7:59 p.m.46 views

CVE-2026-15732

WGDashboard SSRF vulnerability (CVE-2026-15732) affects version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses, enabling Server-Side Request Forgery. Metrics indicate a CRITICAL impact (CVSS 3.1: 9.8, NETWORK, LOW...

9.8CVSS5.6AI score0.00381EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/06 3:17 p.m.11 views

CVE-2026-70646

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

7.5CVSS0.0035EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/06 2:38 p.m.28 views

CVE-2026-70646 aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

7.5CVSS0.0035EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/08/06 2:38 p.m.9 views

CVE-2026-70646 aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

7.5CVSS5.4AI score0.0035EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/06 2:38 p.m.66 views

CVE-2026-70646

CVE-2026-70646 concerns the aiosend Crypto Pay API client. Before version 3.0.7, WebhookHandler.feed_update() deserializes the entire request body prior to HMAC verification, enabling an unauthenticated attacker to trigger expensive JSON parsing and cause CPU/memory exhaustion (pre-auth DoS). The...

7.5CVSS5.6AI score0.0035EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/08/06 2:38 p.m.10 views

CVE-2026-70646

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

7.5CVSS5.6AI score0.0035EPSS
SaveExploits0References4Affected Software1
OSV
OSV
added 2026/08/06 2:38 p.m.9 views

CVE-2026-70646 aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

7.5CVSS5.6AI score
SaveExploits0References5
EUVD
EUVD
added 2026/08/06 2:38 p.m.13 views

EUVD-2026-53920

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

7.5CVSS5.6AI score0.0035EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/05 6:17 p.m.7 views

CVE-2026-70437

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...

3.7CVSS0.00173EPSS
SaveExploits0References1
Rows per page
Query Builder