EUVD-2026-87705

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

CVE-2026-100610

Flowise versions through 3.1.4 are vulnerable to an authorization bypass in the upsert-history functionality. The application fails to perform route-level permission checks, workspace validation, or ownership verification for the GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history end...

CVE-2026-100610 Flowise through 3.1.4 Missing Authorization via upsert-history

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

EUVD-2026-87365

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2026-100685: Incorrect Authorization

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data includin...

CVE-2026-100640: Exposure of Sensitive Information to an Unauthorized Actor

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

PT-2026-99356

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.45.0 Description An issue exists where the system fails to properly scope the 'GET /api/chat-links' endpoint by workspace. This allows users with builder access to a single workspace to enumerate chat identity link...

PT-2026-99317

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent. This occurs because the system incorrectly...

PT-2026-99281

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description Insufficient route-level permission checks and a lack of workspace or ownership validation in the backing service allow authenticated low-privilege users or those with a valid API key to access or...

PT-2026-99311

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description An authorization omission exists in the siyuan-get IPC handler. This allows remote-kernel renderers to access native clipboard formats by invoking the clipboardReadMathML, clipboardReadOffice, and...

PT-2026-99174

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description The software fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments using Active Memory with requester-specific tool rules,...

PT-2026-99176

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description The software fails to revoke memory tool access when an operator hot-disables memory configuration. This occurs because the execution-time resolver treats explicit disablement as an unavailable...

PT-2026-99381

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.12 Description Certain API responses fail to filter sensitive columns, allowing an authenticated non-superadmin admin with the customers see all flag to access the panel domains.dkim privkey field. This occurs whe...

PT-2026-99412

Name of the Vulnerable Software and Affected Versions miniOrange OTP Login, Verification and SMS Notifications versions prior to 5.5.6 Description An authentication bypass exists when the mo wp login intent parameter is used. The issue occurs within the mo by pass login function, specifically in...

PT-2026-99359

Name of the Vulnerable Software and Affected Versions Budibase server versions prior to 3.45.0 Description An information disclosure issue exists where authenticated users can access application metadata and source code belonging to another tenant. By providing a victim tenant's appId to the 'GET...

CVE-2026-100688: Authorization Bypass Through User-Controlled Key

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...

PT-2026-99376

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.19.1 Description An issue exists where the legacy apiCall service executor pkg/engine/apicall/executor.go and the GlobalContextEntry external-API path do not apply the default egress blocklist or scoped-token...

CVE-2026-86066 Horilla attendance approval endpoint is vulnerable to cross-site request forgery

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

CVE-2026-86066 Horilla attendance approval endpoint is vulnerable to cross-site request forgery

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

CVE-2026-100418

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...