CVE-2026-19003

MongoDB BI Connector ODBC Driver vulnerability (CVE-2026-19003) affects the driver’s setup dialog for data sources with overly long path settings. The root cause is an incorrect buffer capacity calculation in the dialog’s file/folder selection handling, which can cause the driver to write outside...

CVE-2026-19311: Undefined Behavior for Input to API

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...

Neo4j Cypher MCP Server Code Execution

The vulnerability of the Neo4j Cypher MCP server is related to a data source verification error. Exploiting this vulnerability allows an attacker to bypass existing security restrictions and execute arbitrary code...

CVE-2026-58248

The CVE describes an XML External Entity (XXE) injection in SAP BusinessObjects Business Intelligence Platform (Web Intelligence). A low-privileged attacker can upload a specially crafted spreadsheet as a data source; when processed, the component resolves external references and exposes contents...

CVE-2026-58248 XML External Entity Injection in SAP BusinessObjects Business Intelligence

SAP BusinessObjects Business Intelligence Platform Web Intelligence allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes t...

CVE-2026-53983

The CVE concerns Ground Station prior to 0.6.0, exposing an unauthenticated blind SSRF via the orbital-source URL path. An unauthenticated Socket.IO client can connect on port 7000 (credentials not required, wildcard CORS) and submit a data_submission with submit-orbital-sources to store an attac...

CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-18485

creationtimestamp| type| source ---|---|--- 2026-08-06 03:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msf2g2vfjh2z...

CVE-2026-69251

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...

NPM: Flowise RCE via TypeORM DataSource

NPM: Flowise RCE via TypeORM DataSource vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

Flowise RCE via TypeORM DataSource

============================================================================= Security Advisory elttam Topic: Flowise RCE via TypeORM DataSource Module: FlowiseAI/Flowise Disclosed: 15-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2 I. Background Flowise AI is an open-source, low-co...

NPM: Flowise RCE via TypeORM DataSource

NPM: Flowise RCE via TypeORM DataSource vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

CVE-2026-69251 Flowise RCE via TypeORM DataSource

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...

EUVD-2026-51822

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...

CVE-2026-67311 Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...

CVE-2026-67311 Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...

Google Chrome Navigation Unauthorized Access

The vulnerability of the Google Chrome browser’s Navigation function is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

SUSE-SU-2026:3419-1 Security update for tomcat

This update for tomcat fixes the following issues: Update to Tomcat 9.0.120. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...