CVE-2026-11800

creationtimestamp| type| source ---|---|--- 2026-06-25 22:17:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5hhhr7qa2r 2026-06-29 13:15:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpgkzuo7ml25 2026-07-01 02:46:32+00:00| seen|...

CVE-2025-71327

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API...

CVE-2025-71327 Flowise - Authentication Bypass via Unprotected Registration Endpoint

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the proxy authentication process. An attacker can gain unauthorized access and impersonate any user, including administrative accounts, by sending a forged HTTP header directly to the server. Additionally,...

CVE-2026-56779

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...

CVE-2026-54089

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc.1, when FileBrowser is configured with proxy authentication auth.method=proxy, any unauthenticated attacker who can reach the server...

CVE-2026-2299 Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint

The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership...

CVE-2026-2299

CVE-2026-2299 affects the Mattermost Google Drive plugin prior to version 1.1.0. The file creation endpoint does not validate channel membership, allowing authenticated users with a connected Google account to share Google Drive files into unauthorized private channels and disclose private channe...

GO-2026-5365 Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration in code.gitea.io/gitea

Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration in code.gitea.io/gitea...

GO-2026-5267 OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types in github.com/openbao/openbao

OpenBao: Transit secrets engine crashes on key creation with derived: true for asymmetric key types in github.com/openbao/openbao...

CVE-2026-50015

creationtimestamp| type| source ---|---|--- 2026-06-25 18:30:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp52rdwmyw2u 2026-06-27 00:35:29+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-rxhj-4m44-96r4 2026-06-29 23:01:49+00:00| seen|...

CVE-2026-50021

creationtimestamp| type| source ---|---|--- 2026-06-25 18:20:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp52ap4dzc2z 2026-06-27 00:35:37+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-q6j5-fjx5-2mc3...

CVE-2026-6091

creationtimestamp| type| source ---|---|--- 2026-06-25 18:17:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4zzxq2wn2f...

CVE-2026-9179

creationtimestamp| type| source ---|---|--- 2026-06-25 18:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp4zy7pl6f2w...

CVE-2026-55697

creationtimestamp| type| source ---|---|--- 2026-06-25 18:13:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4ztxnb3j2o 2026-06-27 00:35:14+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-gj8w-mvpf-x27x...

EUVD-2026-39527

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...

CVE-2026-56779 MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...

CVE-2026-56779 MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...

CVE-2024-11171

creationtimestamp| type| source ---|---|--- 2026-06-25 18:00:46+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mp4z4qzesk2h...

CVE-2026-54089 File Browser: Authentication Bypass via Proxy Auth Header Forgery

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc.1, when FileBrowser is configured with proxy authentication auth.method=proxy, any unauthenticated attacker who can reach the server...