44861 matches found
EUVD-2026-25298
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpoint POST /api/v1/text-to-speech/generate is whitelisted no auth and accepts a credentialId directly in the request body. When called without a chatflowId, th...
CVE-2026-41279 Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpoint POST /api/v1/text-to-speech/generate is whitelisted no auth and accepts a credentialId directly in the request body. When called without a chatflowId, th...
CVE-2026-41279 Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpoint POST /api/v1/text-to-speech/generate is whitelisted no auth and accepts a credentialId directly in the request body. When called without a chatflowId, th...
WordPress Booking Calendar Contact Form plugin <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover vulnerability
Authenticated Subscriber+ Insecure Direct Object Reference to Calendar Takeover vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin Booking Calendar Contact Form versions = 1.2.63...
JLSEC-2026-179
When calling bsonutf8validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via import flow. An attacker can gain remote code execution using company creation endpoint that improperly checks for admin rights in authenticated mode deployment with default configuration. Remediation Upgrade...
Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege
Executive Summary: A bug in Microsoft.AspNetCore.DataProtection 10.0.0-10.0.6 NuGet packages can give an attacker the opportunity to execute an Elevation of Privilege attack by forging authentication cookies, and also allows some protected payloads to be decrypted. If an attacker used forged...
CVE-2025-62373 Pipecat vulnerable to Remote Code Execution by Pickle Deserialization via LivekitFrameSerializer
Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0.0.41 through 0.0.93 have a vulnerability in LivekitFrameSerializer – an optional, non-default, undocumented frame serializer class now deprecated intended for LiveKit...
CVE-2025-62373
Pipecat (versions 0.0.41–0.0.93) contains a remote-code-execution vulnerability in LivekitFrameSerializer, where deserialize() feeds untrusted WebSocket data to pickle.loads() without validation. The vulnerable code is in src/pipecat/serializers/livekit.py (around line 73). If a server uses Livek...
WordPress Learnify theme <= 1.15.0 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Learnify versions = 1.15.0...
CLSA-2026-1776951056 php: Fix of CVE-2019-19203
CVE-2019-19203: fix heap-buffer-overflow in gb18030mbcenclen by installing a GB18030-aware codetombclen and filtering invalid code points from addctypetocc...
CVE-2026-39440
Summary: CVE-2026-39440 affects the WordPress plugin FunnelFormsPro (FunnelForms LLC) up to version 3.8.1. The issue is an improper control of code generation (code injection) that enables Remote Code Inclusion, effectively a Remote Code Execution vulnerability. The description indicates the affe...
CLSA-2026-1776941944 tigervnc: Fix of CVE-2026-34352
CVE-2026-34352: fix world-accessible SHM segment in x0vncserver by changing shmget mode from 0777 to 0600 in ShmImage::Init...
WordPress Monki theme <= 2.0.5 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Phat RiO in WordPress Theme Monki versions = 2.0.5...
WordPress Quiz And Survey Master plugin <= 11.0.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Jakub Herman in WordPress Plugin Quiz And Survey Master versions = 11.0.0...
EUVD-2026-25174
The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetchgravatarfromremote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...
SUSE CVE-2026-31465
In the Linux kernel, the following vulnerability has been resolved: writeback: don't block sync for filesystems with no data integrity guarantees Add a SBINODATAINTEGRITY superblock flag for filesystems that cannot guarantee data persistence on sync eg fuse. For superblocks with this flag set, sy...
SUSE CVE-2026-31466
In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: fix folio isn't locked in softleaftofolio On arm64 server, we found folio that get from migration entry isn't locked in softleaftofolio. This issue triggers when mTHP splitting and zapnonpresentptes races, and the...
SUSE CVE-2026-31492
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Initialize freeqp completion before using it In irdmacreateqp, if ibcopytoudata fails, it will call irdmadestroyqp to clean up which will attempt to wait on the freeqp completion, which is not initialized yet. Fix thi...