Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

308238 matches found

CVE
CVE•added 2026/08/04 2:20 p.m.•85 views

CVE-2026-69250

Summary: CVE-2026-69250 affects Flowise up to version 3.1.2 (pre-3.1.3). The OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is publicly whitelisted and unauthenticated. The endpoint performs a server-side HTTP request to a credential-controlled accessTokenUrl w...

8.5CVSS5.6AI score0.004EPSS
SaveExploits1References3Affected Software1
OSV
OSV•added 2026/08/04 2:20 p.m.•18 views

CVE-2026-69250 Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...

8.5CVSS5.5AI score
SaveExploits0References5
Cvelist
Cvelist•added 2026/08/04 2:20 p.m.•52 views

CVE-2026-69250 Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...

8.5CVSS0.004EPSS
SaveExploits1References3
EUVD
EUVD•added 2026/08/04 2:20 p.m.•13 views

EUVD-2026-52698

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...

8.5CVSS5.6AI score0.004EPSS
SaveExploits1References3
Chainguard
Chainguard•added 2026/08/04 2:17 p.m.•16 views

GHSA-32RQ-JHR7-M3HH vulnerabilities

Vulnerabilities for packages: privatebin, nextcloud-server, drupal...

5.7AI score
SaveExploits0
Chainguard
Chainguard•added 2026/08/04 2:17 p.m.•17 views

GHSA-3FVR-2JW6-CRQ4 vulnerabilities

Vulnerabilities for packages: privatebin, nextcloud-server, drupal...

5.7AI score
SaveExploits0
Chainguard
Chainguard•added 2026/08/04 2:17 p.m.•39 views

CVE-2026-67339 vulnerabilities

Vulnerabilities for packages: privatebin, nextcloud-server, drupal...

6.9CVSS5.7AI score0.00233EPSS
SaveExploits0
Chainguard
Chainguard•added 2026/08/04 2:17 p.m.•18 views

CVE-2026-67355 vulnerabilities

Vulnerabilities for packages: privatebin, nextcloud-server, drupal...

8.2CVSS5.7AI score0.00229EPSS
SaveExploits0
Chainguard
Chainguard•added 2026/08/04 2:17 p.m.•20 views

CVE-2026-67353 vulnerabilities

Vulnerabilities for packages: privatebin, nextcloud-server, drupal...

6.9CVSS5.7AI score0.00247EPSS
SaveExploits0
Chainguard
Chainguard•added 2026/08/04 2:17 p.m.•17 views

CVE-2026-67354 vulnerabilities

Vulnerabilities for packages: privatebin, nextcloud-server, drupal...

8.2CVSS5.7AI score0.00252EPSS
SaveExploits0
Chainguard
Chainguard•added 2026/08/04 2:17 p.m.•53 views

GHSA-MJRX-74JH-7XGW vulnerabilities

Vulnerabilities for packages: privatebin, nextcloud-server, drupal...

5.7AI score
SaveExploits0
Chainguard
Chainguard•added 2026/08/04 2:17 p.m.•14 views

GHSA-MQQ9-GXG5-M58G vulnerabilities

Vulnerabilities for packages: privatebin, nextcloud-server, drupal...

5.7AI score
SaveExploits0
NVD
NVD•added 2026/08/04 2:16 p.m.•11 views

CVE-2026-70367

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...

5.4CVSS0.00156EPSS
SaveExploits0References2
Wolfi
Wolfi•added 2026/08/04 2:16 p.m.•28 views

CVE-2026-67339 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

6.9CVSS5.4AI score0.00233EPSS
SaveExploits0
Wolfi
Wolfi•added 2026/08/04 2:16 p.m.•21 views

CVE-2026-67354 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

8.2CVSS5.4AI score0.00252EPSS
SaveExploits0
Wolfi
Wolfi•added 2026/08/04 2:16 p.m.•17 views

GHSA-32RQ-JHR7-M3HH vulnerabilities

Vulnerabilities for packages: nextcloud-server...

5.4AI score
SaveExploits0
Wolfi
Wolfi•added 2026/08/04 2:16 p.m.•21 views

GHSA-MQQ9-GXG5-M58G vulnerabilities

Vulnerabilities for packages: nextcloud-server...

5.4AI score
SaveExploits0
Wolfi
Wolfi•added 2026/08/04 2:16 p.m.•22 views

CVE-2026-67353 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

6.9CVSS5.4AI score0.00247EPSS
SaveExploits0
Wolfi
Wolfi•added 2026/08/04 2:16 p.m.•19 views

GHSA-3FVR-2JW6-CRQ4 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

5.4AI score
SaveExploits0
Wolfi
Wolfi•added 2026/08/04 2:16 p.m.•25 views

CVE-2026-67355 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

8.2CVSS5.4AI score0.00229EPSS
SaveExploits0
Rows per page
Query Builder