CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-18485

creationtimestamp| type| source ---|---|--- 2026-08-06 03:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msf2g2vfjh2z...

CVE-2026-69251

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...

NPM: Flowise RCE via TypeORM DataSource

NPM: Flowise RCE via TypeORM DataSource vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

Flowise RCE via TypeORM DataSource

============================================================================= Security Advisory elttam Topic: Flowise RCE via TypeORM DataSource Module: FlowiseAI/Flowise Disclosed: 15-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2 I. Background Flowise AI is an open-source, low-co...

NPM: Flowise RCE via TypeORM DataSource

NPM: Flowise RCE via TypeORM DataSource vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

CVE-2026-69251 Flowise RCE via TypeORM DataSource

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...

EUVD-2026-51822

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...

CVE-2026-67311 Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...

CVE-2026-67311 Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...

The vulnerability of the Google Chrome browser’s Navigation function allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Google Chrome browser’s Navigation function is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

SUSE-SU-2026:3419-1 Security update for tomcat

This update for tomcat fixes the following issues: Update to Tomcat 9.0.120. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

Deserialization Of Untrusted Data

c3p0 is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the use of DataSource and ConnectionPoolDataSource objects that can participate in Java deserialization gadget chains, which allows an attacker to trigger arbitrary code execution when malicious serialized object...

EUVD-2026-40847

c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets...

CVE-2026-16332

creationtimestamp| type| source ---|---|--- 2026-07-21 06:02:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr553hh77q2j...

ROS-20260721-73-0041

The vulnerability of the Autofill function in Google Chrome and Microsoft Edge browsers is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow attackers to disclose sensitive information remotely...

EUVD-2026-45212

Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/id endpoint. The handler calls dataSourceService.queryExistentid, ... without an ownership check and returns the decrypted password field, allowing any authenticated non-admin use...

PT-2026-60805

Name of the Vulnerable Software and Affected Versions Chat2DB versions prior to 5.3.0 Description An insecure direct object reference occurs when the application provides direct access to objects based on user-supplied input. In the 'GET /api/connection/datasource/id' endpoint, the handler calls...

CVE-2026-14380

A flaw was found in the DBI component for Perl. This vulnerability allows an attacker to inject and execute arbitrary code by manipulating the Profile attribute of a DBI handle. When a string is assigned to this attribute, the component processes it without proper validation, enabling the executi...

ROS-20260716-73-0002

The vulnerability in Chromium is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker who operates remotely to gain unauthorized access to protected information...