134 matches found
WindMill 路径遍历漏洞
WindMill is a free open-source tool developed by Lukasavicus’ individual developer. It is used to control the execution of tasks in Python. Versions of WindMill prior to 1.603.3 contained a path traversal vulnerability. This vulnerability stemmed from the filename parameter in the getlogfile...
CVE-2026-26964
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. The GET...
CVE-2026-26964
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. The GET...
WindMill 信息泄露漏洞
WindMill is a free open-source tool developed by Lukasavicus’ individual developer. It is used to control the execution of tasks in Python. Versions of WindMill prior to 1.634.6 contained a vulnerability known as “information leakage,” which occurred because the Slack OAuth client token was...
CVE-2026-26964 Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. The GET...
CVE-2026-26964
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. The GET...
CVE-2026-26964 Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. The GET...
CVE-2026-26964
Windmill CVE-2026-26964 affects Windmill versions 1.634.6 and earlier. The issue allows non-admin workspace members to access the Slack OAuth client secret via GET /api/w/{workspace}/workspaces/get_settings, revealing a secret that should be admin-only. Root cause: Slack configuration was stored ...
CVE-2026-26964 Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. The GET...
PT-2026-20970
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. The GET /api/w/workspace/workspaces/get...
CVE-2022-31519
The Lukasavicus/WindMill repository through 1.0 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
EUVD-2024-2794
Malicious code in bioql PyPI...
Malicious code in windmill-yacht-ovlz (npm)
The package windmill-yacht-ovlz was found to contain malicious code...
Malicious code in windmill-ginkgo-ti06 (npm)
The package windmill-ginkgo-ti06 was found to contain malicious code...
Malicious code in windmill-elderberry-gcsv (npm)
The package windmill-elderberry-gcsv was found to contain malicious code...
MAL-2025-39317 Malicious code in windmill-blackhole-ztfa (npm)
The package windmill-blackhole-ztfa was found to contain malicious code...
MAL-2025-31195 Malicious code in quasar-windmill-hhsy (npm)
The package quasar-windmill-hhsy was found to contain malicious code...
MAL-2025-22305 Malicious code in hazel-windmill-tyeg (npm)
The package hazel-windmill-tyeg was found to contain malicious code...