Nautobot (>= 3.0.0a2, < 3.1.2)

Nautobot's Webhook feature is vulnerable to server-side request forgery (SSRF), allowing users with `add` or `change` permissions to make requests to unauthorized hosts, which is fixed in versions 2.4.33 and 3.1.2 by introducing settings to restrict webhook functionality.

A user with permissions to modify GitRepository records can manipulate the `current_head` field via the REST API in Nautobot, leading to repository state desynchronization or unavailability; this is remediated in versions 2.4.33 and 3.1.2.