1148 matches found
CVE-2026-19726
The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...
CVE-2026-19726
The Visualizer WordPress plugin before 4.0.7 has a broken access control flaw: any user with the Contributor role or above can retrieve every chart's full configuration in a single request, potentially exposing remote data source credentials stored in chart settings. CVSS 3.1 scores this MEDIUM (...
EUVD-2026-59919
The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...
CVE-2026-19003
MongoDB BI Connector ODBC Driver vulnerability (CVE-2026-19003) affects the driver’s setup dialog for data sources with overly long path settings. The root cause is an incorrect buffer capacity calculation in the dialog’s file/folder selection handling, which can cause the driver to write outside...
CVE-2026-58248
The CVE describes an XML External Entity (XXE) injection in SAP BusinessObjects Business Intelligence Platform (Web Intelligence). A low-privileged attacker can upload a specially crafted spreadsheet as a data source; when processed, the component resolves external references and exposes contents...
CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL
Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...
CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL
Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...
CVE-2026-53983
The CVE concerns Ground Station prior to 0.6.0, exposing an unauthenticated blind SSRF via the orbital-source URL path. An unauthenticated Socket.IO client can connect on port 7000 (credentials not required, wildcard CORS) and submit a data_submission with submit-orbital-sources to store an attac...
CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL
Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...
CVE-2026-18485
creationtimestamp| type| source ---|---|--- 2026-08-06 03:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msf2g2vfjh2z...
CVE-2026-69251
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...
NPM: Flowise RCE via TypeORM DataSource
NPM: Flowise RCE via TypeORM DataSource vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
Flowise RCE via TypeORM DataSource
============================================================================= Security Advisory elttam Topic: Flowise RCE via TypeORM DataSource Module: FlowiseAI/Flowise Disclosed: 15-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2 I. Background Flowise AI is an open-source, low-co...
NPM: Flowise RCE via TypeORM DataSource
NPM: Flowise RCE via TypeORM DataSource vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
EUVD-2026-51822
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...
CVE-2026-67311 Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...
The vulnerability of the Google Chrome browser’s Navigation function allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Google Chrome browser’s Navigation function is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
SUSE-SU-2026:3419-1 Security update for tomcat
This update for tomcat fixes the following issues: Update to Tomcat 9.0.120. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...