CVE-2026-69258 Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in...

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

MAL-2026-11519 Malicious code in launchdarkly-ai-server-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 460d36c416400537f8c90171c7821b191e0af69df3ec9f0c906300f50b0ea93f launchdarkly-ai-server-sdk 1.0.1 pypi was scanned across 7 files with no a static rule matches and no traced behavior of concern. No install-time or...

MAL-2026-11516 Malicious code in coldcard-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aea0829143169ee7227c8974c3b42125e95b89387a00ccb2b37d1d7344b041a The package presents itself as a helper for the Coldcard hardware wallet, but its actual behavior is credential and wallet theft. setup.py detects...

Malicious code in coldcard-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aea0829143169ee7227c8974c3b42125e95b89387a00ccb2b37d1d7344b041a The package presents itself as a helper for the Coldcard hardware wallet, but its actual behavior is credential and wallet theft. setup.py detects...

CVE-2026-62354

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation...

EUVD-2026-52420

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation...

CVE-2026-62354 Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation...

CVE-2026-16534

The CVE concerns the WordPress plugin “Import and export users and customers” (pre-2.4.2). The root cause is that CSV import does not enforce WordPress role assignments or per-user edit permissions, allowing a user with only the user-creation capability to create an administrator account and over...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in the HostnameUtil class, whose "match CN when no dNSName SAN exists" fallback is gated on Properties.isOverrideSetJSSEHOSTNAMECHECKCNFALLBACK, true, which returns true when the...

CVE-2025-71401 better-auth before 1.4.2 basePath Modification DoS

better-auth npm before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined e.g., BETTERAUTHURL is unset. An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users...

CVE-2026-18572

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours. A flaw was discovered where a user can include a fake time value in their authorization request that overrides the...

CVE-2026-18572

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours. A flaw was discovered where a user can include a fake time value in their authorization request that overrides the...

CVE-2026-18572

Keycloak is affected by a vulnerability in its time-based access control. A flaw allows a user to include a fake time value in an authorization request, which overrides the actual server time and bypasses time-based restrictions, potentially granting access to protected resources outside allowed ...

EUVD-2026-51926

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours. A flaw was discovered where a user can include a fake time value in their authorization request that overrides the...

CVE-2026-18572

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours. A flaw was discovered where a user can include a fake time value in their authorization request that overrides the...

MAL-2026-11425 Malicious code in nvtorch-oot-nightly (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...

Malicious code in nvtorch-oot-nightly (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...

MAL-2026-11426 Malicious code in trtllm-subdir-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d2babc3deb7dd71a0515beeb63a43a5ab1b24bea455226652da9ea9377d1e5f setup.py performs an unconditional HTTP GET to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/trtllmsubdirtest at install time...