CVE-2026-46481 OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TESTCONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in...

org.open-metadata:openmetadata-dist (>=0.12.1 <=DEMO_BETA1), org.open-metadata:openmetadata-k8s-operator (>=1.12.0 <=1.12.10) +2 more potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (>=DEMO_BETA1 <=1.12.3)

org.open-metadata:openmetadata-service MAVEN version =DEMOBETA1, =0.12.1, =1.12.0, =1.10.0, =1.12.10 - org.open-metadata:openmetadata-ui =0.12.1.preview Source cves: CVE-2026-46481 Source advisory: OSV:GHSA-9VMH-WHC4-7PHG...

CVE-2025-46481

Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer flickr-shortcode-importer allows Object Injection.This issue affects Flickr Shortcode Importer: from n/a through = 2.2.3...

WordPress Flickr Shortcode Importer plugin <= 2.2.3 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by Ngo Bui Truong Vu in WordPress Plugin Flickr Shortcode Importer versions = 2.2.3...

CVE-2025-46481

creationtimestamp| type| source ---|---|--- 2025-04-24 17:06:47+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13290...

CVE-2025-46481

Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer flickr-shortcode-importer allows Object Injection.This issue affects Flickr Shortcode Importer: from n/a through = 2.2.3...

CVE-2025-46481 WordPress Flickr Shortcode Importer plugin <= 2.2.3 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer flickr-shortcode-importer allows Object Injection.This issue affects Flickr Shortcode Importer: from n/a through = 2.2.3...

CVE-2025-46481

CVE-2025-46481 describes a Deserialization of Untrusted Data vulnerability in WordPress Flickr Shortcode Importer (

CVE-2025-46481 WordPress Flickr Shortcode Importer <= 2.2.3 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer allows Object Injection. This issue affects Flickr Shortcode Importer: from n/a through 2.2.3...

CVE-2024-46481

The login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS...

CVE-2024-46481

CVE-2024-46481 affects Venki Supravizio BPM up to version 18.1.1. The login page is vulnerable to an open redirect that leads to a reflected XSS. The available documents confirm the vulnerability type (open redirect) and its consequence (reflected XSS) but do not provide specific affected files, ...

CVE-2024-46481

The login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS...

CVE-2021-46481

creationtimestamp| type| source ---|---|--- 2022-01-25 07:18:08+00:00| seen| https://t.me/cibsecurity/36181...

CVE-2021-46481

Jsish v3.5.0 was discovered to contain a memory leak via linenoise at src/linenoise.c...

CVE-2021-46481

Jsish v3.5.0 was discovered to contain a memory leak via linenoise at src/linenoise.c...

CVE-2021-46481

CVE-2021-46481 affects Jsish v3.5.0, with the NVD describing a memory leak via linenoise.c (src/linenoise.c). CNVD-2022-07933 additionally references a buffer/heap overflow vulnerability related to Jsish linenoise operations. The exact affected product/version in public disclosures is Jsish 3.5.0...

elFinder PHP Connector < 2.1.48 - 'exiftran' Command Injection (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'elFinder PHP Connector exiftran Command Injection', 'Description' = %q This module exploits a command injection vulnerability in elFinder version...