CVE-2026-90534

Flowise , a low-code platform for building LLM applications, is affected by a Cross-Workspace Credential IDOR in the POST /api/v1/node-load-method/:name endpoint through version 3.1.3 . The endpoint lacks route-level permission checks and resolves credentials by raw Credential.id via getCredentia...

EUVD-2026-65701

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

CVE-2026-48169

CVE-2026-48169 (PraisonAI Platform) has concrete cross-workspace IDOR and privilege-escalation flaws. The API routes enforce workspace membership but the service layer (in IssueService and ProjectService) performs global primary-key lookups (e.g., get/update/delete) without filtering by workspace...

CVE-2026-42463

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cross-Workspace IDOR Insecure Direct Object Reference and Authorization Bypass vulnerability in the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema...

SQLBot 安全漏洞

SQLBot is an intelligent data querying system developed by DataEase, based on large models and RAG techniques. Versions of SQLBot prior to 1.8.0 contained security vulnerabilities. These vulnerabilities stemmed from cross-workpace IDOR and authorization bypasses in the...