91509 matches found
CVE-2026-70474 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...
Incorrect Authorization
Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Incorrect Authorization via the credential parameter in the affected API endpoints. An attacker can gain unauthorized access to credentials and perform actions in another workspace by supplying a known...
Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store
Summary These endpoints accept a client-controlled credential parameter. The server loads credentials by id and uses them directly, without checking whether that credential belongs to the caller’s workspace. If an attacker knows another workspace’s credentialId, they can use that workspace’s Open...
CVE-2026-70471 Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetche...
CVE-2026-70471 Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetche...
CVE-2026-70471
CVE-2026-70471 – Flowise RBAC bypass : Prior to Flowise 3.1.3, unauthorized users (including keys) could access workspace-scoped variables via /api/v1/node-custom-function because $vars were injected into the code sandbox without requiring variables:view, bypassing the Variables API. Variables fo...
CVE-2026-69252
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...
org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access...
org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access...
org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access...
CVE-2026-24078 Exposure of Private Personal Information to an Unauthorized Actor in Data Modem
Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Oracle Mysql_Server
--- CVE-2026-22015 – Serverless Function Environment Variabl...
GHSA-2364-JH4Q-M9VM Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint
Summary An Insecure Direct Object Reference IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint. This flaw allows an authenticated attacker to bypass authorization checks and retrieve sensitive payment and profile information of other customers by manipulati...
CVE-2026-63248
In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security...
Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
SummaryAny authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a channel:-prefixed chatid and a target messageid. The channel: path routes pipeline output through makechannelemitte...
golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority CA. A remote attacker could potentially exploit this by presenting a revoked key, leading t...
golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the...
CVE-2026-16547
The REST API Log WordPress plugin (versions before 1.7.1 ) is vulnerable to unauthenticated sensitive log data disclosure . The root cause is that the plugin fails to bind the security token protecting its log download feature to the specific log entry being requested, and it does not verify the ...
CVE-2026-15958
The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...