Findomain v11.0.0-beta.2

Findomain The complete solution for domain recognition. Supports screenshotting, port scanning, importing data from other tools, subdomain monitoring, and more. Be alerted on your findings through services such as Discord, Slack, and Telegram. Multiple API Keys for sources and much more. Chat wit...

CVE-2026-86485

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks...

CVE-2026-86485

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks...

CVE-2026-86485

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks...

CVE-2026-86485

JetBrains YouTrack prior to version 2026.2.18634 is vulnerable to IP spoofing via HTTP headers , which allowed an attacker to forge Bitbucket webhook events. The underlying cause is the lack of proper source validation on incoming webhook requests, permitting a local actor with user interaction t...

EUVD-2026-72501

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks...

CVE-2026-86485: Reliance on IP Address for Authentication

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks...

PT-2026-86857

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks...

CVE-2026-80181

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-80181

Apache Allura's webhooks are vulnerable to a Server-Side Request Forgery (SSRF) . This security flaw affects versions up to and including 1.20.0 . An attacker could potentially leverage this vulnerability to make the server perform unintended requests. Remediation is available by upgrading to ver...

CVE-2026-80181 Apache Allura: Server-side request forgery

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

EUVD-2026-70922

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-80181 Apache Allura: Server-side request forgery

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

PT-2026-85428

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-80181: Server-Side Request Forgery (SSRF)

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-77067

The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/callwebhook.ts issues axios.request with that url, t...

CVE-2026-77067

Omnivore (open-source app) is vulnerable to a stored SSRF via the setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts. The resolver stores a caller-supplied URL without any address validation. When a subscribed event fires, callWebhook issues an axios.request to that URL with the r...

CVE-2026-68558 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)

Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery...

CVE-2026-68558

Wekan (open-source kanban built with Meteor) is affected by an SSRF filter bypass in its outgoing webhook Integration URL validator (models/integrations.js) from version 8.36 through 9.73. The validator checked only the literal URL.hostname against regexes, allowing DNS names such as 169-254-169-...

CVE-2026-68558 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)

Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery...