CVE-2026-90580 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...

CVE-2026-90580 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...

CVE-2026-90580

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...

CVE-2026-90580

FlowiseAI Flowise (up to version 3.0.2) contains a server-side request forgery (SSRF) vulnerability in the Evaluations Endpoint . The flaw resides in the axios.post function within packages/server/src/controllers/evaluations/index.ts, where manipulation of the Host or X-Forwarded-Proto header all...

MSC-2026-11617

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-11618

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

Malicious code in host-demo (npm)

The package host-demo was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in gs-uitk-object-utils (npm)

Source: amazon-inspector 662b350826118282a93e76c970ab25659d7bc3a52c58e1e16466e4c432d0d1e5 package.json declares scripts.install: node index.js, which requires ./lib/core. lib/core.js reads the OS username, hostname, and current working-directory basename, assembles them with a hardcoded goldman1...

CVE-2026-90580: Server-Side Request Forgery (SSRF)

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...

CVE-2025-45480

Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary...

PT-2026-90943

Name of the Vulnerable Software and Affected Versions Floodlight version 71fe8a7 Description Link spoofing can lead to the disruption of host communication because a port is misclassified as a non-boundary. Recommendations At the moment, there is no information about a newer version that contains...

CVE-2026-90616

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories e.g., /var/cache, /var/dat...

CVE-2026-90616

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories e.g., /var/cache, /var/dat...

SUSE CVE-2026-89481

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

Malicious code in tracker-cloudflare (npm)

Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the contents of /etc/passwd and /etc/hosts, and POSTs the...

EUVD-2026-76751

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...

CVE-2026-89727

A flaw was found in the Kernel-based Virtual Machine KVM for ARM64 arm64 architecture. A malicious guest operating system can provide an interrupt ID INTID that is outside the expected range to the GICv2 Generic Interrupt Controller version 2 during interrupt deactivation. This can trigger a...

Fedora 44 : nagios-plugins (2026-c2fbd942bc)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c2fbd942bc advisory. Update to upstream bz2453492. checkicmp: host-count overflow leads to heap buffer overflow bz2513957 Update 0012-fix-perl-ntp-ipv6.patch to allow uppercase...

CVE-2026-90616: UNIX Symbolic Link (Symlink) Following

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories e.g., /var/cache, /var/dat...

Fedora 43 : nagios-plugins (2026-7ac5fb031f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7ac5fb031f advisory. Update to upstream bz2453492. checkicmp: host-count overflow leads to heap buffer overflow bz2513957 Update 0012-fix-perl-ntp-ipv6.patch to allow uppercase...