CVE-2026-67621

Flowise 3.1.4 has a missing authorization flaw on document store mutation endpoints (upsert and refresh). This allows authenticated workspace members with only view-level permissions to perform unauthorized document ingestion, refresh the vector database contents, consume embedding API credits, a...

CVE-2026-67621 Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert...

EUVD-2026-53320

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. The handler upserts a...

NPM: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

NPM: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Summary The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history response size 100MB instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data e.g., Vector Store settings such as Qdrant Server URL and collectio...

CVE-2026-70473 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

CVE-2026-70473 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

CVE-2026-70473

Flowise (a UI for building LLM workflows) prior to version 3.1.3 exposed a server-wide upsert-history via GET /api/v1/upsert-history. The endpoint returned data scoped to none of the requester’s identity (user/tenant/workspace) and could exceed 100 MB, including sensitive configuration data such ...

Flowise RCE via SQLite Record Manager Node

============================================================================= Security Advisory elttam Topic: Flowise RCE via SQLite Record Manager Node Module: FlowiseAI/Flowise Disclosed: 24-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2 I. Background Flowise AI is an open-source...

CVE-2026-48063

Baileys (a TypeScript/JavaScript Web WhatsApp API) contains a vulnerability CVE-2026-48063 affecting versions prior to 6.7.22 and 7.0.0-rc12. An attacker can send a malicious protocolMessage payload via placeholderResendMessage to trigger a fake messages.upsert event with a fake message key and p...

CVE-2026-48010

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEMSCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission...

CVE-2026-48010

Summary: CVE-2026-48010 affects Shopware core prior to versions 6.6.10.18 and 6.7.10.1. The vulnerability arises when UserController::upsertUser() writes raw request data in SYSTEM_SCOPE without filtering the admin field, allowing a non-admin API user with user:create or user:update ACL to set ad...

CVE-2026-15736 Multiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemy

Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request...

CVE-2026-35210

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

PYSEC-2026-3445

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

CVE-2026-35210

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

CVE-2026-35210 OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

CVE-2026-35210 OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

CVE-2026-35210

Summary: OpenCTI prior to version 7.260326.0 contains an authorization bypass via the synchronized-upsert: true HTTP header, exploitable by any authenticated user with KNOWLEDGE_KNUPDATE permission. This allows bypassing Confidence Level validation and Object Marking restrictions, enabling attack...

EUVD-2026-42135

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, UpsertWorkspaceApp overwrites an existing app's agentid on a primary-key conflict and insertAgentApp accepts the app ID from the provisioner's CompleteJob...