EUVD-2026-53302

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys proto, constructor, prototype. Because this function is invoked by PreferenceServiceImpl.doResolve for eve...

CVE-2026-14574

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys proto, constructor, prototype. Because this function is invoked by PreferenceServiceImpl.doResolve for eve...

CVE-2026-71204

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update...

CVE-2026-71204

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update. Because WTForms represents an unchecked checkbox as False rather than 'unchanged', and only the 'password' field is special-cased...

CVE-2026-71204 changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update...

EUVD-2026-53201

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update. Because WTForms represents an unchecked checkbox as False rather than 'unchanged', and only the 'password' field is special-cased...

CVE-2026-71204 changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update...

CVE-2026-71204 changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update...

CVE-2026-71204

The CVE-2026-71204 entry concerns changedetection.io. A POST to /settings that omits api_access_token_enabled causes the update logic to silently disable API key enforcement because WTForms treats unchecked checkboxes as False and only the password field is specially handled. This results in the ...

PT-2026-68042

Name of the Vulnerable Software and Affected Versions changedetection.io affected versions not specified Description The /settings save handler creates an update dictionary from form.data'application' and merges it into the stored application settings using the .update method. Due to how WTForms...

PT-2026-68137

Name of the Vulnerable Software and Affected Versions WLED affected versions not specified Description The software contains two security flaws. First, the 'GET /json/cfg' endpoint calls the serveJson function without verifying the settings-PIN, allowing any unauthenticated client on the network ...

PT-2026-68093

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 0.7.0 through 1.73.1 Description The PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys such as proto , constructor, and prototype. This function i...

CVE-2026-14574: Improperly Controlled Modification of Object Prototype Attributes

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys proto, constructor, prototype. Because this function is invoked by PreferenceServiceImpl.doResolve for eve...

PT-2026-68019

Name of the Vulnerable Software and Affected Versions Super Progressive Web Apps versions prior to 2.2.44 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. The superpwa settingsoffline message txt setting is stored without sanitization and...

CVE-2026-70473

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

CVE-2026-70473

Flowise (a UI for building LLM workflows) prior to version 3.1.3 exposed a server-wide upsert-history via GET /api/v1/upsert-history. The endpoint returned data scoped to none of the requester’s identity (user/tenant/workspace) and could exceed 100 MB, including sensitive configuration data such ...

CVE-2026-70473

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

CVE-2026-70473 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

CVE-2026-70473 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

Malicious code in @or-sdk/account-settings (npm)

npm/@or-sdk/account-settings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...