GitSecure

GitSecure 关于 GitSecure GitSecure 是一个 GitHub Action，可用于在推送和拉取请求中警告安全团队任何暴露的 API 密钥。当在 GitHub 仓库中添加或修改文件时，此操作将被触发，并开始在系统中寻找暴露的凭据。找到令牌后，它将通过 Slack Webhook 通知团队。 设置 GitSecure 的设置很简单，不需要太多麻烦。 1. 创建一个 Slack Webhook 你可以通过访问 https://api.slack.com 并创建一个应用来创建 Slack Webhook。创建应用时，选择其为传入 Webhook，并将 Webhook...

CVE-2026-22874-PoC

CVE-2026-22874 — Gitea SSRF PoC ⚠️ DISCLAIMER : Este PoC es SOLO para testing autorizado en instancias Gitea = 1.26.3 Casos de uso legales Investigación de seguridad con autorización explícita Pruebas en laboratorio/desarrollo Validación de mitigaciones Mitigaciones si no puedes aplicar el parche...

gitlab-ssrf

GitLab SSRF Dieses Repository ist eine Nachbildung von CVE-2018-19571 und zeigt, wie es in Kombination mit einem CRLF-Injection-Exploit zu Remote Code Execution RCE führen kann. CVE-Details CVE-2018-19571 GitLab CE/EE, Versionen 8.18 bis 11.x vor 11.3.11, 11.4 vor 11.4.8 und 11.5 vor 11.5.1, sind...

n8n Webhooks - Remote Code Execution

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker,...

CVE-2026-64849

CVE-2026-64849 Altro root@kitploit: POST /api/2.0/mlflow/webhooks HTTP/1.1 Host: Content-Type: application/json "url": "https://httpbin.org/redirect-to?url=http://169.254.169.254/latest/meta-data/", "name": "poc", "events": "action": "CREATED", "entity": "REGISTEREDMODEL" root@kitploit: POST...

sentinel-mcp

SentinelMCP — Sistema di Difesa Cyber Alimentato dall'IA Sottomissione per Google Cloud Hackathon — Rilevamento e correzione autonoma delle minacce orchestrata da Google Cloud Agent Builder Vertex AI Agent , alimentata da Gemini 2.0 Flash, Model Context Protocol MCP e osservabilità Dynatrace. Il...

CVE-2026-77067

The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/callwebhook.ts issues axios.request with that url, t...

CVE-2026-77067

Omnivore (open-source app) is vulnerable to a stored SSRF via the setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts. The resolver stores a caller-supplied URL without any address validation. When a subscribed event fires, callWebhook issues an axios.request to that URL with the r...

CVE-2026-68558 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)

Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery...

CVE-2026-68558

Wekan (open-source kanban built with Meteor) is affected by an SSRF filter bypass in its outgoing webhook Integration URL validator (models/integrations.js) from version 8.36 through 9.73. The validator checked only the literal URL.hostname against regexes, allowing DNS names such as 169-254-169-...

CVE-2026-68558 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)

Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery...

CVE-2026-58440

A flaw was found in Gitea. Webhooks created by a collaborator continue to function even after their repository access is revoked. This incomplete revocation allows for the ongoing, real-time exfiltration of private repository content, leading to information disclosure. Mitigation To mitigate this...

Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence AI platform, and FUXA, an open-source, web-based SCADA / HMI software built for operational technology OT and industrial automation, are witnessing malicious scanning and exploitation efforts. According to...

EUVD-2026-60241

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the...

PT-2026-76685

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the...

CVE-2026-69223

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-69223 Apache Allura: Server-side request forgery

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

EUVD-2026-56286

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-69223 Apache Allura: Server-side request forgery

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-69223

CVE-2026-69223 affects Apache Allura prior to 1.19.1, where the webhooks are vulnerable to Server-Side Request Forgery (SSRF). The issue is rooted in the webhook handling in Allura, with the impact described as high confidentiality and integrity risk but no availability impact, and a network-expl...