117321 matches found
CVE-2026-56278
Flowise before 3.1.0 (affected: 3.0.13 and earlier) uses a weak hardcoded default session secret ('flowise') for express-session when EXPRESS_SESSION_SECRET is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because the secret is publicly visible in the source, an attacker ...
CVE-2026-35505
creationtimestamp| type| source ---|---|--- 2026-06-30 22:06:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjz6qpaiy2z 2026-07-01 02:36:37+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01 2026-07-01 02:53:38+00:00| seen|...
CVE-2026-58447
creationtimestamp| type| source ---|---|--- 2026-06-30 22:04:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjz2m5zsw2s 2026-07-03 10:05:23+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqcc3wwhe27 2026-07-19 19:53:57+00:00| seen|...
CVE-2026-11594
creationtimestamp| type| source ---|---|--- 2026-06-30 22:02:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjywr6fnl23 2026-07-02 01:37:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmvgmmvyb2r 2026-07-03 10:04:47+00:00| seen|...
CVE-2025-36320
creationtimestamp| type| source ---|---|--- 2026-06-30 22:00:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjyt6bsws24 2026-07-01 18:12:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpm4kfefir2l...
CVE-2026-10562
creationtimestamp| type| source ---|---|--- 2026-06-30 21:56:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjymnc2dq25...
CVE-2026-9106
creationtimestamp| type| source ---|---|--- 2026-06-30 21:54:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjyjnm3on24...
CVE-2025-12530
creationtimestamp| type| source ---|---|--- 2026-06-30 21:53:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjygswnxx2k 2026-07-01 18:48:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpm6lpl47j2r 2026-07-02 01:36:48+00:00| seen|...
Malicious code in @businessapp-microsites/apis (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b70ab5da6865ec94b15097fa84836ab41f39b65a5277974b407c545d8d424c7f @businessapp-microsites/[email protected] is a dependency-confusion squat against the private scope @businessapp-microsites, published with an implausibl...
CVE-2026-7871
IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data, and system integrity...
CVE-2026-10546
IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery SSRF vulnerability in the URL component src/lfx/src/lfx/components/datasource/url.py due to a Time-of-Check/Time-of-Use TOCTOU race condition that can be exploited via DNS rebinding...
CVE-2026-12073
creationtimestamp| type| source ---|---|--- 2026-06-30 20:17:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpjt37jnli2e...
EUVD-2026-40401
IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buildpublictmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service...
CVE-2026-10560 Unauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSS
IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buildpublictmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service...
CVE-2026-7663
Langflow OSS 1.0.0–1.9.6 is affected by an improper authorization vulnerability in the Streamable MCP transport endpoint (/api/v1/mcp/project/{project_id}/streamable) that allows unauthenticated attackers to access protected MCP resources and perform MCP operations. IBM bulletin cites cross‑user ...
EUVD-2026-40380
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanism for encryption at rest...
GHSA-H8VQ-8GPG-MHCG Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
Description This is a residual bypass of CVE-2026-46635 / GHSA-vcc8-phrv-43wj that only affects sandboxing enabled through SourcePolicyInterface and not the regular global sandbox mode. CoreExtension::column receives the active sandbox state via the needsissandboxed channel as a boolean...
CVE-2026-58376
creationtimestamp| type| source ---|---|--- 2026-06-30 18:30:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjn5cyb4w2m 2026-07-03 10:06:32+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpqce4xggx2r 2026-07-03 10:06:33+00:00| seen|...
CVE-2026-58372
creationtimestamp| type| source ---|---|--- 2026-06-30 18:25:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjmudi45y2u 2026-07-02 05:56:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpndwv4afe2t...