CVE-2026-69257

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise's HTTP security module httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 before checking them against the deny list...

CVE-2026-69250

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...

CVE-2026-24083 Untrusted Pointer Dereference in Automotive Security

Memory Corruption while processing IOCTL device driver requests with invalid arguments...

CVE-2026-24083

CVE-2026-24083 describes a Memory Corruption in handling IOCTL device driver requests when arguments are invalid. The CVE is associated with Qualcomm devices and shows a Local, Low-Complexity exploit with Privileges Required: Low, and no user interaction, leading to High impact across Confidentia...

CVE-2026-24083 Untrusted Pointer Dereference in Automotive Security

Memory Corruption while processing IOCTL device driver requests with invalid arguments...

CVE-2026-24080 Buffer Copy Without Checking Size of Input in Biometrics

Memory Corruption when handling malformed request parameters in the fingerprint TA...

CVE-2026-24080

The CVE-2026-24080 entry describes a memory corruption issue in the fingerprint TA when processing malformed request parameters. The vulnerability affects a component related to biometric fingerprint handling and is associated with local attack vector, requiring low privileges and provides no use...

CVE-2026-24079

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters...

CVE-2026-24079

Technical details are not publicly available in the provided documents. The available descriptions only mention a cryptographic issue during processing of registration requests with malformed or missing authentication parameters. Monitor for updates.

EUVD-2026-52732

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters...

CLSA-2026-1781225614 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.31.0.post2+tuxcare...

CLSA-2026-1781225615 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.30.0.post2+tuxcare...

CLSA-2026-1780879897 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.32.3.post2+tuxcare...

CLSA-2026-1772496682 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.30.0.post1+tuxcare...

CLSA-2026-1772496680 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.31.0.post1+tuxcare...

CLSA-2026-1772496679 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.25.1.post1+tuxcare...

CLSA-2026-1772496706 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.32.3.post1+tuxcare...

X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent()

A flaw was found in the X.org X11 server, specifically within the GLX OpenGL Extension to the X Window System dispatch layer. A remote attacker can exploit this vulnerability by sending a series of crafted X11 requests. This can lead to a use-after-free condition, where the server attempts to wri...

CVE-2026-69250 Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...

PYSEC-2026-3586 OnionShare Receive mode writes uploaded files even when file uploads are disabled

Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disablefiles setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint --disable-files / "Disable uploading files", a remote sender who can reach the OnionShare service can still sen...