PT-2026-84894

Name of the Vulnerable Software and Affected Versions Drupal Monobank payment API versions 0.0.0 through 1.0.3 Description The Monobank payment API module, used for integrating Monobank acquiring payments, fails to verify the cryptographic signature of webhooks before processing payment status...

PT-2026-84834

Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. Thi...

PT-2026-84867

Name of the Vulnerable Software and Affected Versions rowboatlabs rowboat versions prior to 0.9.2 Description A remote denial of service issue exists in the Composio Webhook Endpoint component. The problem occurs within the request.text/req.json functions located in the...

CLEANSTART-2026-IN11841 Security fixes in rancher-webhook 0.7.10-r1

Package rancher-webhook version 0.7.10-r1 fixes 3 vulnerabilities: ghsa-hrxh-6v49-42gf, CVE-2026-56852, ghsa-gcjh-h69q-9w9g...

CLEANSTART-2026-BM39879 Security fixes in rancher-webhook 0.10.7-r1

Package rancher-webhook version 0.10.7-r1 fixes 2 vulnerabilities: CVE-2026-56852, CVE-2026-41178...

EUVD-2026-68910

A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery...

EUVD-2026-68882

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

CVE-2026-82957

A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery...

CVE-2026-82882

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

CVE-2026-82957 hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery

A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery...

CVE-2026-82957 hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery

A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery...

CVE-2026-82957

CVE-2026-82957 is a server-side request forgery (SSRF) in hyperledger-firefly up to version 1.4.0. The flaw resides in the ValidateOptions function within internal/events/webhooks/webhooks.go of the Webhook Subscription component. Manipulating the url argument allows a remote, unauthenticated att...

CVE-2026-82882 Devtron through 2.2.0 Missing Authorization via webhook API token endpoint

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

CVE-2026-82882 Devtron through 2.2.0 Missing Authorization via webhook API token endpoint

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

CVE-2026-82882 Devtron through 2.2.0 Missing Authorization via webhook API token endpoint

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

CVE-2026-82882

Devtron versions through 2.2.0 fail to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint. Any user with a valid authenticated account can query this endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens...

Malicious code in claude-channel-telegram (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7715d12c1677dbf8b8ba4747cced0f41211f3be783d159685b9108d312d586f1 [email protected] is a dependency-confusion lure with no functional code. package.json wires both preinstall and postinstall lifecycle...

CVE-2026-19410

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and...

CVE-2026-19410 Google Cloud Build Comment Control Bypass via Webhook Suppression

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and...

CVE-2026-19410

Google Cloud Build on GCP contains an Incorrect Authorization flaw in its GitHub Trigger Comment Control feature. Prior to 24 June 2026, a remote attacker with low privileges could use webhook suppression to bypass comment-based authorization and execute unreviewed code in the build environment. ...