PT-2026-70116

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update resource type endpoint. The endpoint omits the administrator permission check that the corresponding delete resource type...

Vault Enterprise vulnerable to cross-namespace entity deletion

Summary Vault Enterprise’s identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability CVE-2026-14886 ...

CVE-2026-71248

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select from user where email = '' and password = ''", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=...

CVE-2026-71248

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = "select from user where email = '$email' and password = '$password'", with no escaping or parameterization, allowing authentication bypass via a payload...

CVE-2026-5581

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the pluploadajaxdeletefile function, which is registered via wpajaxnoprivgfmudeletefile. The...

CVE-2026-70483

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort...

CVE-2026-70483 Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort...

CVE-2026-70483

CVE-2026-70483 (Open WebUI) affects Open WebUI versions 0.9.6 through 0.11.0. The DELETE /api/v1/chats/{id} endpoint could cancel a chat’s in-flight tasks (model response, title generation, or tag generation) without verifying the caller’s permission, enabling any authenticated user who knows ano...

CVE-2026-70483 Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort...

CVE-2026-69262

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, DELETE /api/v1/chatflows/:id authorized requests with checkAnyPermission'chatflows:delete,agentflows:delete', so possession of either permission was sufficient to reach the delete path. The...

NPM: Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

NPM: Flowise: DELETE /api/v1/chatflows/:id does not validate resource type, allowing agentflows:delete and chatflows:delete to delete each other’s flow type vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

summary: In Flowise, DELETE /api/v1/chatflows/:id authorizes requests with checkAnyPermission'chatflows:delete,agentflows:delete'. Possession of either permission is sufficient to reach the delete path. The delete logic does not validate the target resource type, allowing a caller with only...

CVE-2026-69262 Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, DELETE /api/v1/chatflows/:id authorized requests with checkAnyPermission'chatflows:delete,agentflows:delete', so possession of either permission was sufficient to reach the delete path. The...

CVE-2026-69262

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, DELETE /api/v1/chatflows/:id authorized requests with checkAnyPermission'chatflows:delete,agentflows:delete', so possession of either permission was sufficient to reach the delete path. The...

EUVD-2026-52794

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, DELETE /api/v1/chatflows/:id authorized requests with checkAnyPermission'chatflows:delete,agentflows:delete', so possession of either permission was sufficient to reach the delete path. The...

CVE-2026-69082 Cross-Site Request Forgery in the Administrative User Deletion Endpoint

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-66751

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...

CVE-2026-66751

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...

PT-2026-65521

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...

CVE-2026-59240

The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...