Flowise < 3.1.2 - node-custom-function Unauthorized RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

FortiWLM - Directory Traversal

A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specially crafted web requests. id: CVE-2023-34990 info: name: FortiWLM - Directory Traversal author: DhiyaneshDk severity: critical...

Vulnerabilities handled in Fortinet FortiSIEM

Fortinet has identified vulnerabilities in FortiSIEM version 7.5.0. The first vulnerability involves a path traversal issue, where the system does not impose sufficient restrictions on pathnames leading to restricted directories. This allows unauthorized attackers to send specially crafted packet...

CVE-2026-26245

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...

CVE-2026-26245

A SQL injection vulnerability (CWE-89) exists in the Video Station application within the class_videos.php file's getSmartVideosByOffset function. If a remote attacker obtains a valid user account, they can exploit this flaw to execute unauthorized code or commands . The vulnerability is addresse...

EUVD-2026-101973

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...

CVE-2026-26244

A SQL injection vulnerability exists in the Video Station application, specifically within the class_videos.php _getFilters component. If a remote attacker obtains a valid user account, they can exploit this flaw to execute unauthorized code or commands. The vulnerability has been addressed in Vi...

hplip: HP Linux Imaging and Printing Software - Use of DSA Key

A flaw was found in the HP Linux Imaging and Printing Software HPLIP. This vulnerability is due to the use of a weak Digital Signature Algorithm DSA for code signing. A remote attacker could exploit this weakness to forge signatures, potentially leading to the execution of unauthorized code or...

hplip: HP Linux Imaging and Printing Software - Use of DSA Key

A flaw was found in the HP Linux Imaging and Printing Software HPLIP. This vulnerability is due to the use of a weak Digital Signature Algorithm DSA for code signing. A remote attacker could exploit this weakness to forge signatures, potentially leading to the execution of unauthorized code or...

kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation

A flaw was found in the Linux kernel's DisplayPort DP Multi-Stream Transport MST subsystem. This vulnerability involves multiple buffer overflows within the drmdpsidebandappendpayload function when handling data from connected devices. A physically connected, malicious DP MST device can exploit...

CVE-2025-57739

An improper neutralization of special elements used in an SQL Command "SQL Injection" vulnerability CWE-89 vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or command...

CVE-2026-106173

A path traversal vulnerability exists in Fortinet FortiSIEM 7.5.0 due to improper limitation of a pathname to a restricted directory. This flaw allows an attacker to execute unauthorized code or commands by sending specially crafted packets. The vulnerability is characterized by a CRITICAL base s...

CVE-2026-106176

A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests...

SolarView Compact 6.00 - OS Command Injection

SolarView Compact 6.00 was discovered to contain a command injection vulnerability, attackers can execute commands by bypassing internal restrictions through downloader.php. id: CVE-2023-23333 info: name: SolarView Compact 6.00 - OS Command Injection author: Mr-xn severity: critical description: ...

CVE-2026-98214

A flaw was found in the Linux kernel. A local user can bypass Security-Enhanced Linux SELinux access controls to execute restricted files on stacked filesystems. When modifying memory protections using the mprotect system call, the kernel fails to recheck security permissions on intermediate laye...

kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment

A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability arises when asynchronous cryptographic operations incorrectly handle network packet segments, leaving a pointer to memory that has already been released. An attacker could potentially exploit this use-after-free condition t...

EUVD-2026-92813

Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade DFU download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution durin...

CVE-2026-0461

Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade DFU download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution durin...

CVE-2026-0461

Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade DFU download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution durin...

CVE-2026-0461

The AMD Zynq™ UltraScale+ MPSoC and RFSoC devices are vulnerable to a buffer overflow due to insufficient boundary validation in the USB boot mode implementation. An attacker could send unbounded Device Firmware Upgrade (DFU) download requests, causing the DDR receive buffer to overflow into FSBL...