6456 matches found
CVE-2026-69259
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended...
CVE-2026-69259 Flowise RCE via SQLite Record Manager Node
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended...
CVE-2026-69259
Summary: CVE-2026-69259 affects Flowise (SQLite Record Manager node) prior to 3.1.3. The vulnerability arises from user-controlled additionalConfig in SQLiteRecordManager.ts, which could overwrite the SQLite database path, allowing an authenticated attacker using a published Docker image (running...
NPM: Flowise RCE via SQLite Record Manager Node
NPM: Flowise RCE via SQLite Record Manager Node vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
CVE-2026-69251
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...
CVE-2026-18599
A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.setconfig of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument recordsize causes command injection. The exploit has been published...
CVE-2026-18599
GL.iNet GL-MT3000 (up to 4.4.5) is affected by a vulnerability in the Logread Lua RPC Plugin, specifically the logread.set_config function in /usr/lib/oui-httpd/rpc/logread, where manipulation of the record_size argument allows command injection. The flaw, confirmed in the Logread Lua RPC Plugin,...
CVE-2026-10772
DUPLICATE This CVE Record has been rejected by the Zephyr Project CNA. CVE-2026-10772 was assigned to a vulnerability already covered by CVE-2026-2411, which was assigned earlier for the same defect: the Bluetooth GATT notify/indicate paths check the permissions of the Characteristic Declaration...
CVE-2026-67344
ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...
EUVD-2026-51807
ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...
CVE-2026-15450
The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the deletefile AJAX handler retrieving a file path from the database and passing it directly to unlink with no...
Preserving Restored InterSystems IRIS Data Before Removing a Storage System
Article Applicability This article expands on the following note from Epic EHR System Protection Restoring from Storage Snapshot in the Veeam Backup & Replication User Guide: Before you start the restore wizard, create an auxiliary host for the LUN mount in the storage system interface, using any...
CVE-2026-51301
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51299
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51289
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51288
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51287
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51286
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...