Arbitrary File Upload

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary File Upload in the createAttachment in Chatflow. An attacker can upload and persistently store malicious JavaScript files on the server by bypassing MIME type validation, which may...

CVE-2026-40308 My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mcajaxmcjsaction AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parsestr without validation, allowing injection of arbitrary parameters including a site...

MINI-V3V3-GFRP-HW94

Bulletin has no description...

EUVD-2026-23117

Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints...

CVE-2026-37750

creationtimestamp| type| source ---|---|--- 2026-04-16 20:03:02+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/80599 2026-04-16 23:00:12+00:00| published-proof-of-concept| Telegram/PUhI2lkS-h7Gd8doCgJYvIQ2cmMQwA3P2d3rONukexeeEE 2026-04-17 09:00:04+00:00| published-proof-of-concept|...

CVE-2026-40740

Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through = 3.9.7...

CVE-2026-37749

creationtimestamp| type| source ---|---|--- 2026-04-16 19:00:11+00:00| published-proof-of-concept| Telegram/jBpTD-VrkkU4blOwQXqNEQHYP3qYdnW5ne9K2E9cd5frRY 2026-04-16 21:00:04+00:00| published-proof-of-concept| Telegram/YdSs7ODl4GqLLTJMVDK5lc2sRwnfVBIE8xXSYrBaURrpR0I 2026-04-17 15:00:04+00:00|...

EUVD-2026-22910

Missing Authorization vulnerability in Long Watch Studio MyRewards woorewards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyRewards: from n/a through = 5.7.3...

EUVD-2026-22885

Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D viewer – Embed 3D Models: from n/a through = 1.8.5...

CVE-2026-6270 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the...

CVE-2026-3489

The CVE-2026-3489 entry concerns the DirectoryPress WordPress plugin (Business Directory and Classified Ad Listing) with vulnerable versions up to 3.6.26. The issue is an SQL Injection via the 'packages' parameter caused by insufficient escaping of user input and inadequate SQL query preparation,...

Malicious code in @3stripes/toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4529c8ef3e0953799338bc7e0cc7d6ce4f1d8797b3e0984d362ebd26df6bec1c The package @3stripes/toolkit was found to contain malicious code...

MAL-2026-2708 Malicious code in @3stripes/toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4529c8ef3e0953799338bc7e0cc7d6ce4f1d8797b3e0984d362ebd26df6bec1c The package @3stripes/toolkit was found to contain malicious code...

Malicious code in @3stripes/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78177fb122038c79210d2b2a9b477a78c4d918bfc9819382745e541503a7e8ea The package @3stripes/sdk was found to contain malicious code...

MAL-2026-2706 Malicious code in @3stripes/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78177fb122038c79210d2b2a9b477a78c4d918bfc9819382745e541503a7e8ea The package @3stripes/sdk was found to contain malicious code...

Malicious code in @3stripes/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af3a9f22040b78bb5d4973940dff6f5acad0f3a338e26c8f025ca96245acacc9 The package @3stripes/core was found to contain malicious code...

MAL-2026-2704 Malicious code in @3stripes/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fea72a3f12c815ec03d587d20386eb4726c301d381fa23d720c25dc903bdcb4 The package @3stripes/config was found to contain malicious code...

MAL-2026-2705 Malicious code in @3stripes/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af3a9f22040b78bb5d4973940dff6f5acad0f3a338e26c8f025ca96245acacc9 The package @3stripes/core was found to contain malicious code...

Malicious code in @3stripes/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31ba4725ff03b9b0a4645734fca9af46fbd145e147f7fb7ee0942853c425f53f The package @3stripes/components was found to contain malicious code...

MAL-2026-2703 Malicious code in @3stripes/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31ba4725ff03b9b0a4645734fca9af46fbd145e147f7fb7ee0942853c425f53f The package @3stripes/components was found to contain malicious code...