CVE-2026-100625

Capgo capgo.app exposes a native build TUS upload proxy supabase/functions/backend/public/build/upload.ts that authorizes a caller against a single build job identified by the supplied builderjobid and validates only that job's stored uploadpath, but then forwards the user-controlled TUS resource...

CVE-2026-100613

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the transferapp database function transfers an app, its channels, versions and related records to a destination organization...

CVE-2026-100609

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100610

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

CVE-2026-100647

A flaw was found in vLLM. An unauthenticated remote attacker can cause a Denial of Service DoS by sending HTTP requests containing an excessively large cachesalt parameter to exposed API endpoints. Because this input lacks maximum length validation, processing the oversized data consumes excessiv...

CVE-2020-11883

CVE-2020-11883 vue-storefront-api vulnerability 🛠 Setup $ yarn instal $ tsnd . 🧨 Examples Message format $ tsnd . In this example, I tested the "Lights.ie" page. 🙀 Disclaimer This application is for testing purposes only, I am not responsible for any problems that may arise. Please test only wher...

CVE-2025-492030

CVE-2025-492030 Security Advisory: CVE-2025-492030 Overview A critical vulnerability has been identified in the SecureVPN application, which allows for account takeover through a vulnerable API endpoint. This flaw could enable attackers to gain unauthorized access to user accounts, potentially...

CVE-2026-100720 Froxlor before 2.3.12 Stored XSS via SSL certificate issuer

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer the lowest-privileged authenticated role uploads an SSL certificate for one of their own domains, the Certificates API add/update methods parse it with opensslx509parse and store the issuer organization...

CVE-2026-100720 Froxlor before 2.3.12 Stored XSS via SSL certificate issuer

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer the lowest-privileged authenticated role uploads an SSL certificate for one of their own domains, the Certificates API add/update methods parse it with opensslx509parse and store the issuer organization...

EUVD-2026-87693

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer the lowest-privileged authenticated role uploads an SSL certificate for one of their own domains, the Certificates API add/update methods parse it with opensslx509parse and store the issuer organization...

CVE-2026-100720

Froxlor versions 2.0.0 through 2.3.10 are vulnerable to stored cross-site scripting (XSS) . The issue occurs when a customer uploads an SSL certificate; the Certificates API add()/update() methods parse the certificate using openssl_x509_parse() and store the issuer organization (issuer['O']) val...

CVE-2026-100718 Froxlor before 2.3.12 Authentication Bypass via EmailSender.add

Froxlor through 2.3.10 does not enforce the mail.allowexternaldomains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains mail.enableallowsender = 1, mail.allowexternaldomains = 0, an authenticated...

EUVD-2026-87691

Froxlor through 2.3.10 does not enforce the mail.allowexternaldomains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains mail.enableallowsender = 1, mail.allowexternaldomains = 0, an authenticated...

CVE-2026-100718

Froxlor versions through 2.3.10 contain a vulnerability where the EmailSender.add API command fails to enforce the mail.allow_external_domains policy. If an administrator enables the allowed-sender feature but disables external domains (mail.enable_allow_sender = 1, mail.allow_external_domains = ...

CVE-2026-100719 Froxlor before 2.3.12 Credential Disclosure via DirProtections API

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure ...

CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

EUVD-2026-87684

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

CVE-2026-100711

Versions of froxlor prior to 2.3.12 are vulnerable to an authentication bypass because they fail to invalidate panel sessions , API keys , and 2FA trust cookies upon a user password change. This flaw allows attackers who have hijacked a session, obtained a valid API key, or possess a 2FA trust to...

CVE-2026-100710 Froxlor before 2.3.12 DKIM Private Key Disclosure via API

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get, Domains::listing, SubDomains::get, and the admin branch of SubDomains::listing perform a wildcard SELECT over the paneldomains table and return the row unmodified, including the paneldomains.dkimprivkey...