CVE-2026-14643 vulnerabilities

Vulnerabilities for packages: kibana, langfuse-fips, vitess, langfuse, pelias-api, code-server, renovate...

GHSA-JR45-8VMC-QM54 vulnerabilities

Vulnerabilities for packages: kibana, langfuse-fips, vitess, langfuse, pelias-api, code-server, renovate...

CVE-2026-69153 vulnerabilities

Vulnerabilities for packages: keep, langfuse-fips, vitess, gitlab-rails-ce, nextcloud-server, saf, kubeflow-pipelines, langfuse, authentik, semaphore, cadence-web, keep-fips, authentik-fips, arangodb, gitlab-rails-ce-fips, pelias-api, renovate...

GHSA-FXQJ-RQCC-2CMP vulnerabilities

Vulnerabilities for packages: keep, langfuse-fips, vitess, gitlab-rails-ce, nextcloud-server, saf, kubeflow-pipelines, langfuse, authentik, semaphore, cadence-web, keep-fips, authentik-fips, arangodb, gitlab-rails-ce-fips, pelias-api, renovate...

GHSA-RGW5-RVV9-X895 vulnerabilities

Vulnerabilities for packages: nextcloud-server, rancher-api-ui, prism, wazuh-dashboard, authentik-fips, unleash, opentelemetry-auto-instrumentations-node, pelias-api, langfuse-fips, serve, gitlab-rails-ce, saf, actions-runner, npm, langfuse, graalvm, argo-workflows, wazuh-dashboard-fips,...

CVE-2026-69152 vulnerabilities

Vulnerabilities for packages: nextcloud-server, rancher-api-ui, prism, wazuh-dashboard, authentik-fips, unleash, opentelemetry-auto-instrumentations-node, pelias-api, langfuse-fips, serve, gitlab-rails-ce, saf, actions-runner, npm, langfuse, graalvm, argo-workflows, wazuh-dashboard-fips,...

GHSA-RGW5-RVV9-X895 vulnerabilities

Vulnerabilities for packages: prism, sqlpad, npm, ts-patch, argo-workflows, langfuse, nextcloud-server, opensearch-dashboards, pulumi, rancher-api-ui, serve, renovate, saf...

CVE-2026-70483

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort...

EUVD-2026-52896

A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The...

EUVD-2026-52891

A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure...

wp2shell-Hestia-Scanner — Updated!

🛡️ wp2shell-Hestia-Scanner 🇬🇧 English | 🇬🇷 Ελληνικά Read-only WordPress security scanner for HestiaCP servers. Detects wp2shell compromise indicators across all hosted sites — with per-client email reports, core file diff, SHA256 webshell detection, risk scoring, and optional AI evaluation. ⚠️ Safe...

Flowise: Incomplete Credential Redaction Exposes Secrets via API

Summary The GET /api/v1/credentials/:id endpoint decrypts stored credential data and returns it in the plainDataObj field of the API response. While a redactCredentialWithPasswordType function masks fields defined with type: 'password' in their component schema, many credential types store highly...

CVE-2026-70471

CVE-2026-70471 – Flowise RBAC bypass : Prior to Flowise 3.1.3, unauthorized users (including keys) could access workspace-scoped variables via /api/v1/node-custom-function because $vars were injected into the code sandbox without requiring variables:view, bypassing the Variables API. Variables fo...

CVE-2026-70471 Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetche...

CVE-2026-69256

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.readpickle could deserialize a pickled...

CVE-2026-63456

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...

CVE-2026-58071

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins...

CVE-2025-29296

H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection vulnerabilities in the /api/esps request handler. The...

nanoid: nanoid: Predictable ID generation due to integer overflow

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

CVE-2026-69252

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...