57928 matches found
Oracle Linux 9 : kernel (ELSA-2026-49212)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49212 advisory. - net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle CKI Backport Bot RHEL-213299 CVE-2026-64530 - ipc: limit nextid allocation to the valid I...
RHEL 8 : python3 (RHSA-2026:50816)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50816 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...
CVE-2026-66901
creationtimestamp| type| source ---|---|--- 2026-08-04 21:22:42+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3iwqm2chk7oin...
GHSA-3R7G-Q6CG-Q2VX Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...
CVE-2026-69247 vulnerabilities
Vulnerabilities for packages: ggshield, mitmproxy, mycli, dask-kubernetes, superset, in-toto, kserve, kubeflow-volumes-web-app, semgrep, datadog-agent, open-webui, py3-cassandra-medusa, k8s-sidecar, airflow...
CVE-2026-70478
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELISTURLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh...
GHSA-8GJ2-2CVC-6XX7 Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials
Summary The /api/v1/text-to-speech/generate endpoint is whitelisted requires no authentication and accepts any chatflowId without checking whether the referenced chatflow is public. An unauthenticated attacker who knows a valid chatflow UUID can abuse that chatflow's TTS credential OpenAI or...
CVE-2026-70474
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...
GHSA-P5W8-M249-4R4V
creationtimestamp| type| source ---|---|--- 2026-08-04 17:31:02+00:00| seen| https://gist.github.com/alon710/3c340657379dfd929a73082180747c70...
EUVD-2026-52797
A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function removerule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out...
nanoid: nanoid: Predictable ID generation due to integer overflow
A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...
CVE-2026-15307
creationtimestamp| type| source ---|---|--- 2026-08-04 16:29:42+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/h5c2dvuor5uzy 2026-08-04 19:51:38+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msbrxt7kt622 2026-08-05 02:23:12+00:00| seen|...
EUVD-2026-52762
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in...
CVE-2026-69110 OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music
OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...
GHSA-CVXM-645Q-P574
creationtimestamp| type| source ---|---|--- 2026-08-04 15:15:12+00:00| seen| https://gist.github.com/cwayne18/2df919c96745d903491c33321eb89359 2026-08-05 12:34:16+00:00| seen| https://gist.github.com/cwayne18/b5c32c67446c8ec50f54ec955ba4ef5b 2026-08-05 21:55:34+00:00| seen|...
MINI-QH47-R63Q-R35R
Bulletin has no description...
CVE-2024-5866
creationtimestamp| type| source ---|---|--- 2026-08-04 13:00:04+00:00| seen| https://t.me/purpleshift/133 2026-08-05 00:00:30+00:00| seen| https://t.me/purpleshift/133...
Security Bulletin:Pallets Click 8.3.2 Command Injection Vulnerability
Summary Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit function, allowing attackers to pass arbitrary OS commands from an unprivileged account. Vulnerability Details CVEID:CVE-2026-7246 DESCRIPTION: Pallets Click, versions 8.3.2 and below,...
CVE-2026-14202
Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...