CVE-2026-56275

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...

CVE-2026-54892 Plug: quadratic-time decoding of nested query/body parameters enables denial of service

Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 and Plug.Conn.Query.decodeeach/2 parse query strings and application/x-www-form-urlencoded request bodies. When a key contains many...

CVE-2026-56275 Flowise - Server-Side Request Forgery via Execute Flow Base URL

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...

CVE-2026-56275

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...

CVE-2026-56275 Flowise - Server-Side Request Forgery via Execute Flow Base URL

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...

CVE-2026-56275 Flowise - Server-Side Request Forgery via Execute Flow Base URL

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...

CVE-2026-56275

CVE-2026-56275 concerns Flowise prior to 3.1.0, where the Execute Flow node is vulnerable to a server-side request forgery (SSRF). By supplying intranet addresses in the base URL field, an attacker can bypass security validation and initiate HTTP requests to internal network addresses, potentiall...

CVE-2026-56275

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...

CVE-2026-48875

creationtimestamp| type| source ---|---|--- 2026-06-23 10:15:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mox66eggyl2b...

CVE-2026-48868

creationtimestamp| type| source ---|---|--- 2026-06-23 09:15:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mox2synokh2b...

CVE-2026-8379

creationtimestamp| type| source ---|---|--- 2026-06-23 08:21:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mowxtmrwaw2c...

CVE-2026-8378

creationtimestamp| type| source ---|---|--- 2026-06-23 08:16:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mowxko6srr2l...

Improper Access Control

LangGraph Python SDK is vulnerable to Improper Access Control. The vulnerability is due to unsafe URL path construction using unsanitized user-supplied identifiers, where special characters in identifier values can alter the intended request path and target unintended resources, allowing attacker...

CVE-2026-55654

creationtimestamp| type| source ---|---|--- 2026-06-23 07:53:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mowwbexkdi2a 2026-10-13 10:19:23+00:00| seen| MISP/f8adec39-0b02-47ba-9542-6b9dafe336bd...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 — PoC: Path Traversal + RCE via modcgi So...

CVE-2026-41523

creationtimestamp| type| source ---|---|--- 2026-06-23 02:37:07+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3moweld2smf2l 2026-06-23 05:13:50+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mowndjk4ct2x...

CVE-2026-47155

creationtimestamp| type| source ---|---|--- 2026-06-23 01:10:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mow7pttdok2k...

CVE-2026-54232

creationtimestamp| type| source ---|---|--- 2026-06-23 01:05:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mow7gveg3u2j 2026-07-01 11:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mplgiawmxa2x...

CVE-2026-48109

creationtimestamp| type| source ---|---|--- 2026-06-23 00:26:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mow5avfblh2o 2026-07-20 06:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr2olcg7es2s 2026-07-22 14:54:29+00:00| seen|...

OSV-2026-959 Heap-use-after-free in Wt::Http::Request::parseFormUrlEncoded

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=526224351 Crash type: Heap-use-after-free READ 8 Crash state: Wt::Http::Request::parseFormUrlEncoded Wt::CgiParser::parse fuzz-cgi.C...