58199 matches found
GHSA-8GJ2-2CVC-6XX7 Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials
Summary The /api/v1/text-to-speech/generate endpoint is whitelisted requires no authentication and accepts any chatflowId without checking whether the referenced chatflow is public. An unauthenticated attacker who knows a valid chatflow UUID can abuse that chatflow's TTS credential OpenAI or...
CVE-2026-70474
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...
GHSA-P5W8-M249-4R4V
creationtimestamp| type| source ---|---|--- 2026-08-04 17:31:02+00:00| seen| https://gist.github.com/alon710/3c340657379dfd929a73082180747c70...
EUVD-2026-52797
A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function removerule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out...
nanoid: nanoid: Predictable ID generation due to integer overflow
A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...
CVE-2026-15307
creationtimestamp| type| source ---|---|--- 2026-08-04 16:29:42+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/h5c2dvuor5uzy 2026-08-04 19:51:38+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msbrxt7kt622 2026-08-05 02:23:12+00:00| seen|...
EUVD-2026-52762
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in...
CVE-2026-69110 OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music
OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...
GHSA-CVXM-645Q-P574
creationtimestamp| type| source ---|---|--- 2026-08-04 15:15:12+00:00| seen| https://gist.github.com/cwayne18/2df919c96745d903491c33321eb89359 2026-08-05 12:34:16+00:00| seen| https://gist.github.com/cwayne18/b5c32c67446c8ec50f54ec955ba4ef5b 2026-08-05 21:55:34+00:00| seen|...
MINI-QH47-R63Q-R35R
Bulletin has no description...
CVE-2024-5866
creationtimestamp| type| source ---|---|--- 2026-08-04 13:00:04+00:00| seen| https://t.me/purpleshift/133 2026-08-05 00:00:30+00:00| seen| https://t.me/purpleshift/133...
Security Bulletin:Pallets Click 8.3.2 Command Injection Vulnerability
Summary Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit function, allowing attackers to pass arbitrary OS commands from an unprivileged account. Vulnerability Details CVEID:CVE-2026-7246 DESCRIPTION: Pallets Click, versions 8.3.2 and below,...
CVE-2026-14202
Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
CVE-2026-68744
creationtimestamp| type| source ---|---|--- 2026-08-04 07:02:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/aao5xmsbiko4c...
CVE-2026-14872
The CVE affects the Database for Contact Form 7, WPforms, Elementor Forms WordPress plugin, specifically versions before 1.5.5. The root cause is improper sanitisation/escaping of a parameter before use in a SQL statement, enabling a SQL Injection. The vulnerability is exploitable by users with a...
CVE-2026-16536
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 is affected by an unauthenticated Server-Side Request Forgery (SSRF) due to not validating a user-supplied URL before performing a server-side request (via the calendar_id flow). Root cause: absence of URL validation i...
GHSA-MQ44-7P77-Q5H7
creationtimestamp| type| source ---|---|--- 2026-08-04 04:31:10+00:00| seen| https://gist.github.com/alon710/8b85a9db45c3273615bc588dcd240ceb...
kernel: ipc: limit next_id allocation to the valid ID range
A flaw was found in the Linux kernel. The ipcidralloc function, used in the checkpoint/restore path for SysV Inter-Process Communication IPC ID allocation, does not properly limit ID allocation to the valid range. This can result in the system attempting to dereference freed memory, leading to a...
CVE-2026-69243
creationtimestamp| type| source ---|---|--- 2026-08-04 03:31:26+00:00| seen| https://gist.github.com/alon710/b3523524be79c42fa548f91ed3953ea3 2026-08-04 21:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96645 2026-08-05 00:00:21+00:00| published-proof-of-concept|...