CVE-2025-70962

Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized...

CVE-2025-63822

SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the...

CVE-2025-70962

CVE-2025-70962 affects Zosi C519M, version V4.2.8.823C01450BA. The issue is Incorrect Access Control due to hardcoded credentials in the RTSP authentication, allowing network-remote access to the RTSP video stream and unauthorized camera viewing. A PoC/exploit is available (GitHub: https://github...

EUVD-2026-42658

Ghost: Paid gift memberships obtainable at minimal cost via the donations feature...

CVE-2026-70619 Odysseus Missing Admin Authorization via Embedding Endpoint Routes

Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers...

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that getverifieduser enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...

CVE-2026-70490

Open WebUI (self-hosted AI platform) versions 0.8.8–0.11.0 contain a flaw where the terminal WebSocket route in backend/open_webui/routers/terminals.py authenticates its own first-message JWT and omits the verified-user role gate enforced on HTTP terminal routes. As a result, accounts with pendin...

CVE-2026-70476

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept...

CVE-2026-70554 MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...

GHSA-GMMW-QG98-6J6P Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Summary Several organization billing endpoints accept attacker-controlled Stripe identifiers subscriptionId without verifying that the identifier belongs to the authenticated user's organization. This allows an authenticated attacker to perform unauthorized Stripe subscription operations on other...

Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Summary Several organization billing endpoints accept attacker-controlled Stripe identifiers subscriptionId without verifying that the identifier belongs to the authenticated user's organization. This allows an authenticated attacker to perform unauthorized Stripe subscription operations on other...

CVE-2026-70476 Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept...

CVE-2026-70476 Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept...

CVE-2026-70476

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept...

Flowise: Missing Authorization on Execution Update Endpoint

Flowise Security Audit Report Date: 2026-03-17 Researcher: Dimpal Jadhav [email protected] GitHub: https://github.com/Dimpyj1604 Target: FlowiseAI/Flowise latest main branch Version: [email protected] FINDING 1: Missing Authorization on Execution Update Endpoint Severity: HIGH CVSS 7.5...

CVE-2026-70474

Flowise (flows builder UI) has a cross-workspace OAuth2 credential metadata leak prior to version 3.1.3. Three OAuth2 credential endpoints—/api/v1/oauth2-credential/authorize/, /api/v1/oauth2-credential/callback?code=ATTACKER_AUTH_CODE&state=, and /api/v1/oauth2-credential/refresh/—query the Cred...

CVE-2026-70474 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...

CVE-2026-70474

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

Summary These endpoints accept a client-controlled credential parameter. The server loads credentials by id and uses them directly, without checking whether that credential belongs to the caller’s workspace. If an attacker knows another workspace’s credentialId, they can use that workspace’s Open...

GHSA-8R8H-6VCC-XHRV Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

Finding — Unauthorized Workspace Variables disclosure via $vars injection bypasses variables:view What’s wrong code locations - Variables for the active workspace are fetched without checking “variables:view” at this call site: flowise-src/ packages/components/src/utils.ts:932 - Runtime variables...