CVE-2026-69252

Flowise CVE-2026-69252: Before 3.1.3, the /api/v1/files route was protected only by feat:files and did not enforce checkPermission on GET/DELETE. A low-privileged, authenticated API key could list files under the organization root and delete files in other workspaces within the same organization ...

WordPress ShopLentor plugin <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter vulnerability

Unauthenticated Server-Side Request Forgery via URL Parameter vulnerability discovered by mikemyers in WordPress Plugin ShopLentor versions = 3.1.2...