CVE-2026-55640: Missing Authentication for Critical Function

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: qdrant, ntpd-rs, linkerd2-proxy, rustls-ffi, wasmtime, xh, zizmor, zola, rustup, lychee, pixi, wasmcloud, buck2, sqlx, zed, wasm-pack, atuin, wash, cargo-audit, wadm, nushell, samply, deno, rye, oranda, parseable, tealdeer, uv, linkerd-extension-init, kdash,...

GHSA-FR6G-7CQ8-FG82 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Summary The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history response size 100MB instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data e.g., Vector Store settings such as Qdrant Server URL and collectio...

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Summary The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history response size 100MB instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data e.g., Vector Store settings such as Qdrant Server URL and collectio...

CVE-2026-70473 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

CVE-2026-70473 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

CVE-2026-70473

Flowise (a UI for building LLM workflows) prior to version 3.1.3 exposed a server-wide upsert-history via GET /api/v1/upsert-history. The endpoint returned data scoped to none of the requester’s identity (user/tenant/workspace) and could exceed 100 MB, including sensitive configuration data such ...

CVE-2026-70473

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

CVE-2026-70473 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

PT-2026-67920

Summary The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history response size 100MB instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data e.g., Vector Store settings such as Qdrant Server URL and collectio...

CLEANSTART-2026-CS37148 Security fixes in qdrant 1.16.3-r0

Package qdrant version 1.16.3-r0 fixes 1 vulnerabilities: ghsa-8v2v-wjwg-vx6r...

PT-2026-85847

Package qdrant version 1.16.3-r0 fixes 1 vulnerabilities: ghsa-8v2v-wjwg-vx6r...

AnythingLLM - Information Disclosure Detection

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be exposed in plain text to unauthenticate...

Qdrant UI - Unauthenticated Access Detection

Qdrant UI Dashboard was detected and appeared to be accessible without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Qdrant UI Dashboard was detected and appeared to be accessible without authentication.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

GHSA-7GCF-G7XR-8HXJ vulnerabilities

Vulnerabilities for packages: pixi, cedar, atuin, komodo, yazi, qdrant, lychee, zed...

GHSA-7GCF-G7XR-8HXJ vulnerabilities

Vulnerabilities for packages: atuin, lychee, qdrant, pixi, zed, cedar, yazi...

cnry-mcp-server-qdrant (>=0.0.2, <=0.8.3), mad-mcp-qdrant (>=1.1.3, <=1.9.3) +4 more potentially affected by CVE-2025-64340 via fastmcp (2.7.0)

fastmcp PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - cnry-mcp-server-qdrant =0.0.2, =1.1.3, =0.8.1, =0.8.1.1 - mcp-server-qdrant-openai 0.8.1 Source cves: CVE-2025-64340 Source advisory:...

cnry-mcp-server-qdrant (>=0.0.2, <=0.8.3), mad-mcp-qdrant (>=1.1.3, <=1.9.3) +4 more potentially affected by CVE-2026-27124 via fastmcp (2.7.0)

fastmcp PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - cnry-mcp-server-qdrant =0.0.2, =1.1.3, =0.8.1, =0.8.1.1 - mcp-server-qdrant-openai 0.8.1 Source cves: CVE-2026-27124 Source advisory:...

cognee-community-hybrid-adapter-falkor (0.2.0), cognee-community-vector-adapter-qdrant (0.2.0) potentially affected by CVE-2026-58473 via cognee (0.5.1)

cognee PYPI version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on cognee and may be impacted: - cognee-community-hybrid-adapter-falkor 0.2.0 - cognee-community-vector-adapter-qdrant 0.2.0 Source cves: CVE-2026-58473 Source advisory:...

cognee-community-hybrid-adapter-falkor (0.2.5), cognee-community-retriever-code (>=0.1.4, <=0.1.5) +3 more potentially affected by CVE-2026-58473 via cognee (0.5.6)

cognee PYPI version 0.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on cognee and may be impacted: - cognee-community-hybrid-adapter-falkor 0.2.5 - cognee-community-retriever-code =0.1.4, =0.1.4, =0.1.5 - cognee-community-vector-adapter-qdrant 0.2.4...