EUVD-2026-11198

Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-link to start the cosign flow. The submission reference is communicated so that the user can retrieve the submission to be cosigned...

Always-Incorrect Control Flow Implementation

Overview Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to incorrect state handling in nested execution paths involving the ICS20 precompile. An attacker can repeatedly utilize the same token balance within a single transaction by exploiting...

EUVD-2026-11123

The Modular DS: Monitor, update, and backup multiple websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing nonce validation on the postConfirmOauth function. This makes it possible for unauthenticated attacker...

EUVD-2026-10930

Flowise affected by Server-Side Request Forgery SSRF in HTTP Node Leading to Internal Network Access...

CVE-2026-31813: Authentication Bypass by Spoofing

Supabase Auth is a JWT based API for managing users and issuing JWT tokens. Prior to 2.185.0, a vulnerability has been identified that allows an attacker to issue sessions for arbitrary users using specially crafted ID tokens when the Apple or Azure providers are enabled. The attacker issues a...

PT-2026-24717

Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-link to start the cosign flow. The submission reference is communicated so that the user can retrieve the submission to be cosigned...

CVE-2026-28803: Improper Access Control

Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-link to start the cosign flow. The submission reference is communicated so that the user can retrieve the submission to be cosigned...

CVE-2026-31829 Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including...

com.vaadin:collaboration-engine (4.0.0), com.vaadin:com.vaadin.gradle.plugin (22.0.0) +109 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (9.0.0)

com.vaadin:flow-server MAVEN version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:collaboration-engine 4.0.0 - com.vaadin:com.vaadin.gradle.plugin 22.0.0 - com.vaadin:flow 9.0.0 -...

com.vaadin:com.vaadin.gradle.plugin (>=22.0.26, <=22.0.27), com.vaadin:flow (9.0.24) +100 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (9.0.24)

com.vaadin:flow-server MAVEN version 9.0.24 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:com.vaadin.gradle.plugin =22.0.26, =22.0.27 - com.vaadin:flow 9.0.24 - com.vaadin:flow-client 9.0.24 -...

com.vaadin:com.vaadin.gradle.plugin (22.1.6), com.vaadin:flow (9.1.10) +103 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (9.1.10)

com.vaadin:flow-server MAVEN version 9.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:com.vaadin.gradle.plugin 22.1.6 - com.vaadin:flow 9.1.10 - com.vaadin:flow-client 9.1.10 -...

com.vaadin:com.vaadin.gradle.plugin (22.2.2), com.vaadin:flow (9.2.3) +100 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (9.2.3)

com.vaadin:flow-server MAVEN version 9.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:com.vaadin.gradle.plugin 22.2.2 - com.vaadin:flow 9.2.3 - com.vaadin:flow-client 9.2.3 -...

com.alibaba.rsocket:alibaba-broker-server (>=1.1.3, <=1.1.4), com.github.mcollovati.vertx:vaadin-flow-sockjs (>=23.1.0, <=23.4.1) +276 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (>=23.0.0, <=23.6.6)

com.vaadin:flow-server MAVEN version =23.0.0, =1.1.3, =23.1.0, =23.1.0, =23.4.0-alpha1, =23.4.0-alpha1, =1.0.0-alpha1, =1.0.0-alpha1, =1.0.0-alpha1, =1.0.0-alpha1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.7.0, =5.7.0, =5.7.1 and more Source cves: CVE-2026-2742 Source advisory:...

com.alibaba.rsocket:alibaba-broker-server (>=1.1.3, <=1.1.4), com.github.mcollovati.vertx:vaadin-flow-sockjs (>=23.1.0, <=23.4.1) +276 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (>=23.0.0, <=23.6.6)

com.vaadin:flow-server MAVEN version =23.0.0, =1.1.3, =23.1.0, =23.1.0, =23.4.0-alpha1, =23.4.0-alpha1, =1.0.0-alpha1, =1.0.0-alpha1, =1.0.0-alpha1, =1.0.0-alpha1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.7.0, =5.7.0, =5.7.1 and more Source cves: CVE-2026-2742 Source advisory:...

com.vaadin:appsec-kit-starter (2.0.0), com.vaadin:flow (2.9.10) +93 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (2.9.10)

com.vaadin:flow-server MAVEN version 2.9.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:appsec-kit-starter 2.0.0 - com.vaadin:flow 2.9.10 - com.vaadin:flow-client 2.9.10 -...

com.github.fluorumlabs:code-quality-test (1.0.0), com.vaadin:com.vaadin.gradle.plugin (0.17.0.0) +90 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (4.0.0)

com.vaadin:flow-server MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.github.fluorumlabs:code-quality-test 1.0.0 - com.vaadin:com.vaadin.gradle.plugin 0.17.0.0 - com.vaadin:flow 4.0...

com.github.mcollovati.vertx:vaadin-flow-sockjs (17.0.0), com.github.mcollovati.vertx:vertx-vaadin-flow (17.0.0) +18 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (4.0.1)

com.vaadin:flow-server MAVEN version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.github.mcollovati.vertx:vaadin-flow-sockjs 17.0.0 - com.github.mcollovati.vertx:vertx-vaadin-flow 17.0.0 -...

com.vaadin:com.vaadin.gradle.plugin (21.0.1), com.vaadin:flow (8.0.1) +100 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (8.0.1)

com.vaadin:flow-server MAVEN version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:com.vaadin.gradle.plugin 21.0.1 - com.vaadin:flow 8.0.1 - com.vaadin:flow-client 8.0.1 -...

com.vaadin:com.vaadin.gradle.plugin (21.0.2), com.vaadin:flow (8.0.2) +101 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (8.0.2)

com.vaadin:flow-server MAVEN version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.vaadin:com.vaadin.gradle.plugin 21.0.2 - com.vaadin:flow 8.0.2 - com.vaadin:flow-client 8.0.2 -...

com.holon-platform.vaadin:holon-starter-vaadin-flow (5.2.0-rc2), com.holon-platform.vaadin:holon-starter-vaadin-flow-undertow (5.2.0-rc2) +33 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (1.1.0)

com.vaadin:flow-server MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.holon-platform.vaadin:holon-starter-vaadin-flow 5.2.0-rc2 -...