CVE-2026-13229 Zammad 7.0.1 - Improper authorization in ticket article attachment cloning

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint...

GHSA-RWRP-9823-P2XQ Flowise: Incomplete Credential Redaction Exposes Secrets via API

Summary The GET /api/v1/credentials/:id endpoint decrypts stored credential data and returns it in the plainDataObj field of the API response. While a redactCredentialWithPasswordType function masks fields defined with type: 'password' in their component schema, many credential types store highly...

CVE-2026-69262

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, DELETE /api/v1/chatflows/:id authorized requests with checkAnyPermission'chatflows:delete,agentflows:delete', so possession of either permission was sufficient to reach the delete path. The...

CVE-2026-18787

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function removerule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out...

CVE-2026-18787 GL.iNet AX1800 RPC Endpoint oui-rpc.lua remove_rule command injection

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function removerule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out...

CVE-2026-18787

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function removerule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out...

EUVD-2026-52797

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function removerule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out...

NPM: Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

NPM: Flowise: DELETE /api/v1/chatflows/:id does not validate resource type, allowing agentflows:delete and chatflows:delete to delete each other’s flow type vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

summary: In Flowise, DELETE /api/v1/chatflows/:id authorizes requests with checkAnyPermission'chatflows:delete,agentflows:delete'. Possession of either permission is sufficient to reach the delete path. The delete logic does not validate the target resource type, allowing a caller with only...

CVE-2026-69262 Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, DELETE /api/v1/chatflows/:id authorized requests with checkAnyPermission'chatflows:delete,agentflows:delete', so possession of either permission was sufficient to reach the delete path. The...

EUVD-2026-52794

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, DELETE /api/v1/chatflows/:id authorized requests with checkAnyPermission'chatflows:delete,agentflows:delete', so possession of either permission was sufficient to reach the delete path. The...

CVE-2026-69262

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, DELETE /api/v1/chatflows/:id authorized requests with checkAnyPermission'chatflows:delete,agentflows:delete', so possession of either permission was sufficient to reach the delete path. The...

CVE-2026-69098

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...

GHSA-6VH2-WG4H-4VWJ Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API

Summary The POST /api/v1/prediction/:id endpoint — which is unauthenticated whitelisted in WHITELISTURLS — accepts an overrideConfig object in the request body. This object is unconditionally spread into the internal flowConfig and flowData objects at two locations in the codebase without checkin...

Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API

Summary The POST /api/v1/prediction/:id endpoint — which is unauthenticated whitelisted in WHITELISTURLS — accepts an overrideConfig object in the request body. This object is unconditionally spread into the internal flowConfig and flowData objects at two locations in the codebase without checkin...

CVE-2026-69258

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in...

EUVD-2026-52762

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in...

CVE-2026-69250

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...

EUVD-2026-52740

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...

CVE-2026-69098 kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...