CVE-2026-58437

Repository Visibility Manipulation via Git Push Options...

EUVD-2026-58164

Repository Visibility Manipulation via Git Push Options...

EUVD-2026-58142

Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...

CVE-2026-56443 Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...

CVE-2026-56443 Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...

CVE-2026-56443 Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...

CVE-2026-56443

Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...

CVE-2026-73603

Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a...

EUVD-2026-57807

Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a...

CVE-2026-73603 Flowise before 3.1.4 Credential Abuse via Text-to-Speech

Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a...

CVE-2026-73603

Flowise before 3.1.4 exposes an unauthenticated text-to-speech endpoint that does not validate chatflow visibility, allowing unauthenticated attackers to abuse private chatflow TTS credentials and generate unlimited TTS audio using stored OpenAI or ElevenLabs keys by providing a valid chatflow UU...

CVE-2026-58437: Improper Access Control

Repository Visibility Manipulation via Git Push Options...

CVE-2026-56443: Incorrect Authorization

Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...

CVE-2026-73155

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react handler passed an attacker-controlled commentid directly to...

EUVD-2026-55972

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react handler passed an attacker-controlled commentid directly to...

PT-2026-70080

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description Authenticated users can add or remove emoji reactions on comments without authorization checks to verify if they are permitted to view the target comment. The react handler passes a...

CVE-2026-68396

In the Linux kernel, the following vulnerability has been resolved: scsi: core: wake eh reliably when using scsischeduleeh Drivers which use the scsischeduleeh function to run the error handler currently risk the error handler thread never waking once all commands are timed out or inactive. There...

CVE-2026-68396

The CVE-2026-68396 entry concerns the Linux kernel SCSI subsystem, specifically the core’s handling of error recovery when using scsi_schedule_eh. The issue was a race where the error handler thread could fail to wake reliably because there was no enforced memory order between marking the host in...

EUVD-2026-54145

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

CVE-2026-64662 Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished...