CVE-2026-100640

SiYuan versions before v3.8.4 are vulnerable to an authorization omission in the siyuan-get IPC handler. This flaw allows remote-kernel renderers to access native clipboard formats by invoking specific commands, including clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS, using match...

CVE-2026-100640 SiYuan before v3.8.4 Clipboard Data Disclosure via IPC

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

CVE-2026-100610 Flowise through 3.1.4 Missing Authorization via upsert-history

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

EUVD-2026-87705

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

CVE-2026-100610

Flowise versions through 3.1.4 are vulnerable to an authorization bypass in the upsert-history functionality. The application fails to perform route-level permission checks, workspace validation, or ownership verification for the GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history end...

EUVD-2026-87365

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

PT-2026-99356

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.45.0 Description An issue exists where the system fails to properly scope the 'GET /api/chat-links' endpoint by workspace. This allows users with builder access to a single workspace to enumerate chat identity link...

CVE-2026-100685: Incorrect Authorization

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data includin...

PT-2026-99359

Name of the Vulnerable Software and Affected Versions Budibase server versions prior to 3.45.0 Description An information disclosure issue exists where authenticated users can access application metadata and source code belonging to another tenant. By providing a victim tenant's appId to the 'GET...

CVE-2026-100688: Authorization Bypass Through User-Controlled Key

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...

CVE-2026-100640: Exposure of Sensitive Information to an Unauthorized Actor

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

PT-2026-99174

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description The software fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments using Active Memory with requester-specific tool rules,...

PT-2026-99376

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.19.1 Description An issue exists where the legacy apiCall service executor pkg/engine/apicall/executor.go and the GlobalContextEntry external-API path do not apply the default egress blocklist or scoped-token...

CVE-2026-86066 Horilla attendance approval endpoint is vulnerable to cross-site request forgery

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

CVE-2026-86066 Horilla attendance approval endpoint is vulnerable to cross-site request forgery

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

CVE-2026-100418

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2026-100418

The software Flame through 2.4.0 contains an information exposure vulnerability within the unauthenticated GET /api/config endpoint. The root cause is a lack of field redaction, allowing the endpoint to return the entire configuration object. Attackers can send a single unauthenticated request to...

CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...