45981 matches found
CVE-2026-73603
Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a...
CVE-2026-73604
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...
EUVD-2026-57812
SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4 contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization...
EUVD-2026-57811
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents...
CVE-2026-73607 SiYuan before v3.7.4 Information Disclosure via getOutlineStorage
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents...
CVE-2026-73607
SiYuan: Information disclosure vulnerability in /api/storage/getOutlineStorage on versions before v3.7.4 allows retrieving outline state (including heading IDs) for any document without authorization. This affects confidentiality; upgrade to v3.7.4+ (the fix) or apply vendor advisories. Per sourc...
EUVD-2026-57810
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers...
CVE-2026-73606
SiYuan before version 3.7.4 is vulnerable to information disclosure via the /api/block/getRefIDs endpoint. The issue arises because password-protected document tiers are not checked, allowing unauthenticated readers to discover that certain documents reference specific blocks and to obtain block ...
CVE-2026-73606 SiYuan before v3.7.4 Information Disclosure via getRefIDs
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers...
CVE-2026-73604
Flowise (pre-3.1.3) has an incomplete credential redaction vulnerability in GET /api/v1/credentials/:id that exposes decrypted secrets to authenticated users with credentials:view. Impact described includes database connection URLs with passwords, cloud service account JSON with private keys, and...
EUVD-2026-57808
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...
CVE-2026-73604 Flowise before 3.1.3 Credential Exposure via API
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...
CVE-2026-73604 Flowise before 3.1.3 Credential Exposure via API
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...
Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-95)
Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A...
Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-102)
Missing Authorization in Kibana Leading to Information Disclosure Description: Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal Kibana data retrieval capability used by Elastic Defend...
CVE-2026-11970
This vulnerability allows a normal non-admin user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E Mac OS before v26.04.5758...
CVE-2026-11970
CVE-2026-11970 affects Forcepoint One Endpoint on macOS (F1E) prior to v26.04.5758. A normal (non-admin) user can disable the Forcepoint One Endpoint SafariExtension, thereby bypassing DLP protection. The CVSS 4.8 vector indicates local access with low privileges and no user interaction. Exploita...
CVE-2026-11970
This vulnerability allows a normal non-admin user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E Mac OS before v26.04.5758...
