CVE-2026-18859

A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be...

PT-2026-68022

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 3.6.3 Description Authenticated users can exploit a missing authorization check in the JSON-RPC dispatcher. The application fails to implement ownership checks, session pinning, or permission-attribute gates for...

ROS-20260805-73-0006

The vulnerability in the modules drivers/net/ethernet/intel/ice/iceeswitch.c and drivers/net/ethernet/intel/ice/icemain.c of the Linux kernel is related to pointer manipulation. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260805-73-0026

The vulnerability of the ishtpclbusmatch function in Linux operating systems is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a system crash in the Linux kernel...

OPENSUSE-SU-2026:11457-1 perl-Date-Manip-6.990.0-2.1 on GA media

These are all security issues fixed in the perl-Date-Manip-6.990.0-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-18812

A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The...

CVE-2026-70552

MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any -ajax.php file in the codebase...

CVE-2026-65986 CVAT has stored XSS via annotation guide assets

CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be accessed through annotation guide assets. When CVAT serves the files attached to an annotation guide, it labels them with a media type...

CVE-2026-65986 CVAT has stored XSS via annotation guide assets

CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be accessed through annotation guide assets. When CVAT serves the files attached to an annotation guide, it labels them with a media type...

EUVD-2026-52909

MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any -ajax.php file in the codebase...

CVE-2026-70552 MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php

MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any -ajax.php file in the codebase...

CVE-2026-70552

MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any -ajax.php file in the codebase...

CVE-2026-70552

MaxSite CMS

Authorization Bypass Through User-Controlled Key

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the updateSubscriptionPlan and updateAdditionalSeats processes. An attacker can perform unauthorized billing operations on other tenants by supplying a...

GHSA-GMMW-QG98-6J6P Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Summary Several organization billing endpoints accept attacker-controlled Stripe identifiers subscriptionId without verifying that the identifier belongs to the authenticated user's organization. This allows an authenticated attacker to perform unauthorized Stripe subscription operations on other...

Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Summary Several organization billing endpoints accept attacker-controlled Stripe identifiers subscriptionId without verifying that the identifier belongs to the authenticated user's organization. This allows an authenticated attacker to perform unauthorized Stripe subscription operations on other...

CVE-2026-70476 Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept...

CVE-2026-70476 Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept...

CVE-2026-70476

Flowise (drag‑and‑drop UI for building LLM flows) has a Broken Access Control in Stripe subscription endpoints. Prior to version 3.1.3, endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accepted attac...

CVE-2026-70476 Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept...