CVE-2026-90533 Flowise before 3.1.4 Broken Access Control via organizationuser

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with an...

PT-2026-90638

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with an...

CVE-2026-54348

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...

CVE-2026-72607

Koha SQL injection (CVE-2026-72607) is a stored, authenticated vulnerability affecting Koha up to 26.05.01 and earlier 24.11.17/25.05.12/25.11.06. An authenticated staff member with items_batchmod can store a payload in the agefield of an automatic modification rule; the value is written to a sys...