CVE-2026-47623

creationtimestamp| type| source ---|---|--- 2026-08-04 18:12:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2bly5qs5x5ynn 2026-08-08 13:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msl6vsra472o...

CVE-2026-69255

creationtimestamp| type| source ---|---|--- 2026-08-04 18:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbmftr7f42o 2026-08-06 20:45:21+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-per-flowise 2026-09-16 20:00:44+00:00| exploited|...

CVE-2026-70474

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...

GHSA-8R8H-6VCC-XHRV Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

Finding — Unauthorized Workspace Variables disclosure via $vars injection bypasses variables:view What’s wrong code locations - Variables for the active workspace are fetched without checking “variables:view” at this call site: flowise-src/ packages/components/src/utils.ts:932 - Runtime variables...

CVE-2026-70471 Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetche...

CVE-2026-70471 Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetche...

CVE-2026-18790 Systerel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-bounds

A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMacProcessMsgDeleteMonitoredItemsResponse of the file src/ClientServer/frontend/clientwrapper/internal/statemachine.c of the component DeleteMonitoredItemsRequest Handler. This manipulation causes...

CVE-2026-24253

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service and data tampering...

CVE-2026-69263

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LDLIBRARYPATH, DYLDLIBRARYPATH, and NODEOPTIONS by exact...

CVE-2026-64634

A vulnerability allowing local privilege escalation to the Reporter service context...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are affected by a security bypass vulnerability (CVE-2026-10842)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are affected by a security bypass vulnerability with the appSecurity-1.0, appSecurity-2.0 , appSecurity-3.0 or appSecurity-4.0 feature enabled. Vulnerability...

CVE-2026-10032

creationtimestamp| type| source ---|---|--- 2026-08-04 16:48:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/j7o7c57m4b5cj 2026-10-02 23:30:28+00:00| seen| https://gist.github.com/alon710/bbef448ddedc6cabee70ea28e567bc12...

CVE-2026-21366

creationtimestamp| type| source ---|---|--- 2026-08-04 16:45:15+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-qualcomm-10...

CVE-2026-25289

creationtimestamp| type| source ---|---|--- 2026-08-04 16:45:02+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-qualcomm-10 2026-08-04 18:16:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbmmzbd3g2m 2026-08-04 23:37:36+00:00| seen|...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-5241

Summary IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-5241, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-5241 DESCRIPTION: A vulnerability in the LightGlue...

CVE-2026-15830

creationtimestamp| type| source ---|---|--- 2026-08-04 16:29:42+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/h5c2dvuor5uzy 2026-09-16 20:00:13+00:00| seen| https://bsky.app/profile/djangonews.bsky.social/post/3mvnwirlrtq2s 2026-09-23 23:00:10+00:00| seen|...

CVE-2026-58074

A vulnerability allowing a high-privileged user to execute arbitrary code on the server...

CVE-2026-64634

A vulnerability allowing local privilege escalation to the Reporter service context...

CVE-2026-64634

A vulnerability allowing local privilege escalation to the Reporter service context...

GHSA-C6XH-WV4J-PPV5 Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

Summary Flowise's HTTP security module httpSecurity.ts fails to normalize IPv4-mapped IPv6 addresses e.g., ::ffff:127.0.0.1, ::ffff:169.254.169.254 before checking them against the deny list. Due to an ipaddr.js kind mismatch ipv6 vs ipv4, all IPv4 CIDR deny rules are silently skipped for...