CVE-2026-90494: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in restify node-restify up to 12.0.0. This affects the function serveStatic in the library /lib/plugins/static.js. This manipulation causes path traversal. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any w...

PT-2026-90784

Name of the Vulnerable Software and Affected Versions restify node-restify versions prior to 12.0.1 Description A remote path traversal flaw exists in the serveStatic function within the /lib/plugins/static.js library. Path traversal is a technique that allows an attacker to access files and...

CVE-2026-90534

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

CVE-2026-90534 Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

EUVD-2026-76852

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

CVE-2026-90534 Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

CVE-2026-90534

Flowise , a low-code platform for building LLM applications, is affected by a Cross-Workspace Credential IDOR in the POST /api/v1/node-load-method/:name endpoint through version 3.1.3 . The endpoint lacks route-level permission checks and resolves credentials by raw Credential.id via getCredentia...

CVE-2026-90534 Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

PT-2026-90639

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

CVE-2026-90534: Authorization Bypass Through User-Controlled Key

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

Linux Distros Unpatched Vulnerability : CVE-2026-89723

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nilfs2: fix slab-out-of-bounds in nilfsdirectpropagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in...

CVE-2026-89744

A flaw was found in the Linux kernel's device property handling. When the kernel iterates over child nodes of a firmware node fwnode that also has a secondary fwnode, the fwnodegetnextchildnode function can enter an endless loop. This occurs if the secondary fwnode has multiple children, causing...

CVE-2026-89723

A flaw was found in the nilfs2 file system component of the Linux kernel. When a file is truncated, an intermediate node block is not properly deleted and remains in the B-tree node cache. This can lead to the log writer incorrectly processing the block, resulting in a slab-out-of-bounds memory...

AZL-100109 CVE-2026-89723 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfsdirectpropagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfsdirectpropagate during testing. Analysis revealed that after truncating a file...

CVE-2026-89723

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfsdirectpropagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfsdirectpropagate during testing. Analysis revealed that after truncating a file...

UBUNTU-CVE-2026-89723

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfsdirectpropagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfsdirectpropagate during testing. Analysis revealed that after truncating a file...

CVE-2026-89723

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfsdirectpropagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfsdirectpropagate during testing. Analysis revealed that after truncating a file...

DEBIAN-CVE-2026-89495

In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlmmigraterequesthandler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node in ...

CVE-2026-89723 nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfsdirectpropagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfsdirectpropagate during testing. Analysis revealed that after truncating a file...

CVE-2026-89723

CVE-2026-89723 affects the nilfs2 file system component of the Linux kernel . The root cause is that when a B-tree mapping collapses into a direct mapping during file truncation, an intermediate node block immediately below the B-tree root is left orphaned in the B-tree node cache in a dirty stat...