EUVD-2026-54169

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert...

Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing

Summary There is a low severity vulnerability in Traefik's BasicAuth middleware. Concurrent password verifications are deduplicated through a singleflight group whose key was the delimiter-free concatenation of the submitted password and the stored secret, so a request carrying an unconfigured...

WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Aydan Arabadzha in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

CVE-2026-18510

CVE-2026-18510 affects TranslatePress – Translate Multilingual (WordPress) up to version 3.2.6. Root cause: insufficient input sanitization and output escaping, enabling unauthenticated stored XSS via Comment Content. Attackers can inject arbitrary scripts in pages viewed by users; payloads use W...

CVE-2026-63263 vulnerabilities

Vulnerabilities for packages: ruby3.2-elasticsearch, ruby4.0-elasticsearch, ruby3.3-elasticsearch, ruby3.4-elasticsearch...

CVE-2026-11977 WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

Photon OS 5.0: Python3 PHSA-2024-5.0-91-0187

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0187. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

RHEL 9 : python3.12 (RHSA-2026:50770)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50770 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

CVE-2026-70478

Summary of CVE-2026-70478 (Flowise) : The unauthenticated endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is exposed via WHITELIST_URLS and decrypts the stored credential to perform an OAuth token refresh, returning a new access_token in the response. An attacker with a valid creden...

CVE-2026-70478 Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELISTURLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh...

CLSA-2026-1784856221 TuxCare security update for ws (1 CVE)

TuxCare rebuilt ws to address 1 CVE. Fixed in 3.3.3-tuxcare.2...

CLSA-2026-1779410892 TuxCare security update for 82 packages (4 CVEs)

TuxCare rebuilt 82 packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.3...

CLSA-2026-1777163883 TuxCare security update for trim-newlines (10 CVEs)

TuxCare rebuilt trim-newlines to address 10 CVEs. Fixed in 3.0.0-tuxcare.1...

CLSA-2026-1775781172 TuxCare security update for rollup (3 CVEs)

TuxCare rebuilt rollup to address 3 CVEs. Fixed in 3.15.0-tuxcare.1...

CLSA-2026-1773015258 TuxCare security update for hawk (5 CVEs)

TuxCare rebuilt hawk to address 5 CVEs. Fixed in 3.1.0-tuxcare.1...

CVE-2026-18631 jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization

A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the component PreAuthorize Handler. The manipulation leads to authorization...

RLSA-2026:47183 Important: compat-libtiff3 security update

The libtiff3 package provides libtiff 3, an older version of libtiff library for manipulating TIFF Tagged Image File Format image format files. This version should be used only if you are unable to use the current version of libtiff. Security Fixes: libtiff: libtiff: Heap-based buffer overflow vi...

PT-2026-67406

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description The '/api/search/searchEmbedBlock' endpoint passes a client-supplied SQL statement directly to the main read-write siyuan.db handle without restrictions on single statements, read-only access, or...

GHSA-7QF5-7PPR-87V8 Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8rxv-jg7p-wvg3. This link is maintained to preserve external references. Original Description Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX...

CVE-2026-67306

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...