SUSE CVE-2025-11143

The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently fr...

CVE-2026-26127

A flaw was found in .NET. An unauthorized attacker can exploit an out-of-bounds read vulnerability over a network, leading to a Denial of Service DoS. This can prevent legitimate users from accessing the affected service. Mitigation To mitigate this issue, restrict network access to applications...

Server-side Request Forgery (SSRF)

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the HTTP Node as it is used in AgentFlow and Chatflow. An attacker can access internal network resources, retrieve sensitive information, or modify and...

Cross-site Scripting (XSS)

Overview sylius/sylius is a platform for PHP, based on Symfony framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the rendering of entity names within various frontend and admin panel components, such as breadcrumbs, taxon pickers, and autocomplete fields,...

EUVD-2026-10913

Sylius affected by IDOR in Cart and Checkout LiveComponents...

Sylius affected by IDOR in Cart and Checkout LiveComponents

Impact An authenticated Insecure Direct Object Reference IDOR vulnerability exists in multiple shop LiveComponents due to unvalidated resource IDs accepted via LiveArg parameters. Unlike props, which are protected by LiveComponent's @checksum, args are fully user-controlled - any action that...

CVE-2026-31833 Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering

Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration /.+/ in the UFM DOMPurify instance, event handler...

copilot-studio-datainsight (>=0.0.1, <=0.0.6), flowise (>=1.6.1, <=1.8.4) potentially affected by CVE-2026-31829 via flowise-components (>=1.3.4, <=1.8.6)

flowise-components NPM version =1.3.4, =0.0.1, =1.6.1, =1.8.4 Source cves: CVE-2026-31829 Source advisory: MEND:CVE-2026-31829...

CVE-2026-31820

Sylius (Open Source eCommerce on Symfony) contains an authenticated insecure direct object reference (IDOR) in multiple LiveComponents. The vulnerability stems from unvalidated resource IDs accepted via #[LiveArg] parameters, where loading with -&gt;find() occurs without ownership checks. Affecte...

com.vaadin:flow (2.13.0-beta1), com.vaadin:flow-client (2.13.0-beta1) +91 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.13.0-beta1)

com.vaadin:flow-server MAVEN version 2.13.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:flow 2.13.0-beta1 - com.vaadin:flow-client 2.13.0-beta1 - com.vaadin:flow-component-demo-helpers...

com.vaadin:flow (9.0.5), com.vaadin:flow-client (9.0.5) +13 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (9.0.5)

com.vaadin:flow-server MAVEN version 9.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:flow 9.0.5 - com.vaadin:flow-client 9.0.5 - com.vaadin:flow-component-demo-helpers 9.0.5 -...

com.vaadin:com.vaadin.gradle.plugin (22.0.16), com.vaadin:flow (9.0.14) +103 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (9.0.14)

com.vaadin:flow-server MAVEN version 9.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:com.vaadin.gradle.plugin 22.0.16 - com.vaadin:flow 9.0.14 - com.vaadin:flow-client 9.0.14 -...

com.vaadin:com.vaadin.gradle.plugin (22.0.22), com.vaadin:flow (9.0.19) +102 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (9.0.19)

com.vaadin:flow-server MAVEN version 9.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:com.vaadin.gradle.plugin 22.0.22 - com.vaadin:flow 9.0.19 - com.vaadin:flow-client 9.0.19 -...

it.tidalwave.northernwind:it-tidalwave-northernwind-frontend-components-vaadin (>=1.0.0, <=1.0.51), it.tidalwave.northernwind:it-tidalwave-northernwind-frontend-vaadin (>=1.0-alpha-5, <=1.1-alpha-34) +3 more potentially affected by CVE-2026-2742 via com.vaadin:vaadin (6.6.1)

com.vaadin:vaadin MAVEN version 6.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - it.tidalwave.northernwind:it-tidalwave-northernwind-frontend-components-vaadin =1.0.0, =1.0-alpha-5, =1.0-alpha-5, =1.0.0,...

com.vaadin:flow (2.10.6), com.vaadin:flow-client (2.10.6) +17 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.10.6)

com.vaadin:flow-server MAVEN version 2.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:flow 2.10.6 - com.vaadin:flow-client 2.10.6 - com.vaadin:flow-component-demo-helpers 2.10.6 -...

com.vaadin:flow (2.11.3), com.vaadin:flow-client (2.11.3) +12 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.11.3)

com.vaadin:flow-server MAVEN version 2.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:flow 2.11.3 - com.vaadin:flow-client 2.11.3 - com.vaadin:flow-component-demo-helpers 2.11.3 -...

com.vaadin:flow (2.13.2), com.vaadin:flow-client (2.13.2) +12 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.13.2)

com.vaadin:flow-server MAVEN version 2.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:flow 2.13.2 - com.vaadin:flow-client 2.13.2 - com.vaadin:flow-component-demo-helpers 2.13.2 -...

com.vaadin:flow (2.13.6), com.vaadin:flow-client (2.13.6) +91 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.13.6)

com.vaadin:flow-server MAVEN version 2.13.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:flow 2.13.6 - com.vaadin:flow-client 2.13.6 - com.vaadin:flow-component-demo-helpers 2.13.6 -...

com.vaadin:flow (3.0.0), com.vaadin:flow-client (3.0.0) +86 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (3.0.0)

com.vaadin:flow-server MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:flow 3.0.0 - com.vaadin:flow-client 3.0.0 - com.vaadin:flow-component-demo-helpers 3.0.0 -...

com.vaadin:flow (3.0.4), com.vaadin:flow-client (3.0.4) +9 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (3.0.4)

com.vaadin:flow-server MAVEN version 3.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:flow 3.0.4 - com.vaadin:flow-client 3.0.4 - com.vaadin:flow-component-demo-helpers 3.0.4 -...