124548 matches found
CVE-2026-50023
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files such as .desktop, .url, .webloc to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitl...
CVE-2026-50023
CVE-2026-50023 affects yt-dlp. Before 2026-06-09, an issue allowed remote attackers to write arbitrary OS-shortcut files (e.g., .desktop, .url, .webloc) via the --write-link option by exploiting unsafe extensions that were on the allowlist, bypassing the prior CVE-2024-38519 remediation. This cou...
CVE-2026-54304
n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node's report download...
Exploit for OS Command Injection in Apache Tomcat
CVE-2019-0232 — Apache Tomcat CGI Servlet RCE Educational...
GHSA-W4HM-RRXG-PXCF Duplicate Advisory: Flowise Execute Flow function has an SSRF vulnerability
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9hrv-gvrv-6gf2. This link is maintained to preserve external references. Original Description Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows...
CVE-2025-71376
creationtimestamp| type| source ---|---|--- 2026-06-23 14:52:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxnnmxy7m2q 2026-09-23 20:35:19+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-7cq8-mj8x-j263 2026-10-01 18:50:04+00:00| seen|...
CVE-2026-56225
creationtimestamp| type| source ---|---|--- 2026-06-23 14:19:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxlsg2pk52s...
CVE-2026-54892
creationtimestamp| type| source ---|---|--- 2026-06-23 14:07:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxl5ook3g2a 2026-09-23 14:32:29+00:00| seen| https://gist.github.com/alon710/979d7d899727637e6e9c2c6d617956b2 2026-09-23 14:35:58+00:00| seen|...
CVE-2025-71341
creationtimestamp| type| source ---|---|--- 2026-06-23 13:59:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxkqcdnog2l 2026-09-23 20:35:14+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-6vqj-c2q5-j97w 2026-10-01 18:40:06+00:00| seen|...
CVE-2026-56275
Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...
CVE-2026-54892 Plug: quadratic-time decoding of nested query/body parameters enables denial of service
Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 and Plug.Conn.Query.decodeeach/2 parse query strings and application/x-www-form-urlencoded request bodies. When a key contains many...
CVE-2026-56275 Flowise - Server-Side Request Forgery via Execute Flow Base URL
Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...
CVE-2026-56275 Flowise - Server-Side Request Forgery via Execute Flow Base URL
Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...
CVE-2026-56275
Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...
CVE-2026-56275
Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...
CVE-2026-56275
CVE-2026-56275 concerns Flowise prior to 3.1.0, where the Execute Flow node is vulnerable to a server-side request forgery (SSRF). By supplying intranet addresses in the base URL field, an attacker can bypass security validation and initiate HTTP requests to internal network addresses, potentiall...
CVE-2026-56275 Flowise - Server-Side Request Forgery via Execute Flow Base URL
Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...
CVE-2026-48875
creationtimestamp| type| source ---|---|--- 2026-06-23 10:15:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mox66eggyl2b...