103887 matches found
GHSA-C2C9-MFW7-P8HW Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows
Summary The /api/v1/chatflows/apikey/:apikey endpoint whitelisted, accessible with API key auth only returns all chatflows bound to the provided API key AND all chatflows across the entire system that have no API key assigned. This crosses workspace boundaries, allowing a user in Workspace A who...
Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows
Summary The /api/v1/chatflows/apikey/:apikey endpoint whitelisted, accessible with API key auth only returns all chatflows bound to the provided API key AND all chatflows across the entire system that have no API key assigned. This crosses workspace boundaries, allowing a user in Workspace A who...
CVE-2026-5783 Reflected XSS in Beyaz Computer's CityPLus
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Beyaz Computer Software Design Industry and Trade Ltd. Co. CityPLus allows Reflected XSS. This issue affects CityPLus: before V24.29750.1.0...
libsndfile: integer overflow in ima_reader_init()
A flaw was found in the libsndfile library. An integer overflow in the IMA ADPCM codec can occur when a specially crafted WAV audio file is processed, specifically with malicious samplesperblock and blocks values. This can lead to a heap-based buffer overflow, causing a crash to the application...
EUVD-2026-31067
The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing unauthenticated attackers to enumerate registered user email addresses...
Astra Linux – Vulnerability in Mariadb 10.3
MariaDB version 10.5.13 allows a hamaria::extra application to crash due to certain SELECT statements...
Astra Linux – Vulnerability in vsftpd
ALPACA is an application layer protocol content confusion attack, exploiting TLS servers that implement different protocols but use compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker, who has access to the victim’s traffic at the TCP/IP layer, can redirect...
Astra Linux – Vulnerability in DjVuLibre
A flaw was discovered in djvulibre-3.5.28 and earlier. An integer overflow in the render function in tools/ddjvu, through a crafted djvu file, may cause the application to crash and lead to other issues...
Astra Linux – Vulnerability in docker.io-app
Moby version 25.0.3 has a race condition vulnerability in the StreamFormatter package. This vulnerability can be exploited to trigger multiple concurrent write operations, leading to data corruption or application crashes...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: The block mode of switchdev is used when ADQ is active, and vice versa. ADQ and switchdev are not allowed to be enabled simultaneously. Enabling both at the same time can lead to nullptr dereferencing. To prevent this issue, chec...
Astra Linux – Vulnerability in Mariadb 10.3
In MariaDB version 10.5.9, an application can crash due to certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations related to temporary data structures...
Astra Linux – Vulnerability in Nettle
A flaw was discovered in the way Nettle’s RSA decryption functions handled specially crafted ciphertext. An attacker could exploit this flaw to deliver manipulated ciphertext, resulting in application crashes and denial of service...
Astra Linux – Vulnerability in Mariadb 10.3
MariaDB before version 10.6.5 has a sqllex.cc integer overflow issue, which can lead to an application crash...
Astra Linux – Vulnerability in Zabbix
Stored or persistent cross-site scripting XSS is a type of XSS attack where the attacker first sends the malicious payload to the web application. The application then stores the payload e.g., in a database or server-side text files. Eventually, the application inadvertently executes the payload...
Astra Linux – Vulnerability in Chromium
In versions of Google Chrome on Android prior to 101.0.4951.41, the security interface in the Downloads section allowed a remote attacker to spoof the APK download dialog box through a crafted HTML page...
Astra Linux – Vulnerability in SQLite3
SQLite 3.30.1 improperly handles certain SELECT statements involving a non-existent VIEW, resulting in an application crash...
Astra Linux – Vulnerability in glibc
The mqnotify function in the GNU C Library also known as glibc versions 2.32 and 2.33 has a use-after-free vulnerability. It may access the notification thread attributes object passed through its struct sigevent parameter after it has been freed by the caller, resulting in a denial of service...
Astra Linux – Vulnerability in DjVuLibre
A flaw was discovered in djvulibre-3.5.28 and earlier. A malicious read operation in the function DJVU::DataPool::hasdata, through a crafted djvu file, may cause the application to crash and lead to other issues...