Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 397 total.
Missing authorization to unauthenticated arbitrary media deletion in Multi Uploader for Gravity Forms (CVE-2026-5581)
The Multi Uploader for Gravity Forms WordPress plugin contains missing capability checks in the `plupload_ajax_delete_file()` function, registered via `wp_ajax_nopriv_gfmu_delete_file`. The nonce intended for CSRF pro...
Fixed in 1.1.9
Password reset link poisoning in Kadence Memberships WordPress plugin (CVE-2026-9273)
The Membership Plugin - Kadence Memberships for WordPress contains a password reset link poisoning vulnerability in its legacy lost-password handler, which consumes an attacker-controlled POST parameter into two unval...
Fixed in 4.0.1
Heap buffer overflow in libXfont2 font server client glyph handling (CVE-2026-44950)
A heap buffer overflow exists in fs_read_glyphs() within the libXfont2 font-server client (src/fc/fserve.c). Per-glyph validation confirms each source slice lies within the source bitmap buffer but does not verify tha...
Fixed in libXfont2-2.0.9
Unauthenticated OAuth2 token refresh endpoint in Flowise (CVE-2026-70478)
The OAuth2 token refresh endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) in Flowise is included in `WHITELIST_URLS`, requiring no authentication. An attacker who obtains a credential ID can call this...
Fixed in 3.1.3
Python validator Unicode homoglyph bypass in Flowise (CVE-2026-70470)
The `validatePythonCodeForDataFrame` function in Flowise's `pythonCodeValidator.ts` enforces a JavaScript regex blacklist against dangerous Python identifiers, but JavaScript word-boundary anchors (`\b`) are ASCII-onl...
Fixed in npm flowise 3.1.3; npm flowise-components 3.1.3
Remote code execution in Flowise CSVAgent via unsanitized csvFile interpolation (CVE-2026-69264)
Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template executed by Pyodide without any content validation. Because Pyodide's default js bridg...
Fixed in 3.1.3
Remote code execution in FlowiseAI Flowise via SQLite Record Manager Node (CVE-2026-69259)
The SQLite Record Manager node in Flowise accepts a user-controlled `additionalConfig` input whose contents are spread into the SQLite options object after the `database` property is set, allowing an authenticated att...
Fixed in flowise 3.1.3; flowise-components 3.1.3
Remote code execution via pickle deserialization in Flowise CSVAgent (CVE-2026-69256)
The CSVAgent node in Flowise passes user-supplied input directly into a Python code template executed via pyodide, relying on a denylist to block dangerous constructs. An attacker can bypass this denylist by invoking ...
Fixed in npm flowise 3.1.3; npm flowise-components 3.1.3
JavaScript sandbox escape leading to RCE in Flowise (CVE-2026-69253)
An authenticated attacker can escape the vm2 JavaScript sandbox used by Flowise's AgentAsTool, ChatflowTool, and ExecuteFlow nodes by injecting arbitrary code through an unsanitized baseURL parameter, which is interpo...
Fixed in flowise 3.1.3; flowise-components 3.1.3
NodeVM sandbox escape leading to RCE in Flowise (CVE-2026-69254)
A sandbox escape vulnerability in Flowise's `executeJavaScriptCode()` function allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function merges caller-provided `nod...
Fixed in flowise 3.1.3; flowise-components 3.1.3
Remote code execution in FlowiseAI Flowise via TypeORM DataSource (CVE-2026-69251)
Flowise exposes arbitrary TypeORM DataSource options through the `additionalConfig` node input in multiple record manager and agent memory nodes. An authenticated user can abuse options such as `entities`, `subscriber...
Fixed in 3.1.3
Stack-based buffer overflow in Ivanti Connect Secure, Policy Secure, and ZTA Gateways (CVE-2025-22457)
A stack-based buffer overflow vulnerability exists in Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti ZTA Gateways. A remote unauthenticated attacker can exploit this vulnerability to achieve remote code execu...
Fixed in Ivanti Connect Secure 22.7R2.6
Authentication bypass in SmarterTools SmarterMail password reset API (CVE-2026-23760)
SmarterMail's AuthenticationService.ForceResetPassword endpoint accepts unauthenticated requests and does not verify an existing password or reset token when resetting system administrator account credentials. An unau...
Fixed in Build 9511
Code injection in Tenable Sensor Proxy (CVE-2026-18667)
A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host. The flaw is classified as code in...
Fixed in Sensor Proxy 1.4.2
Message spoofing and app state corruption in Baileys (CVE-2026-48063)
Baileys sessions can be sent a malicious payload via the placeholderResendMessage mechanism, triggering a fake `messages.upsert` event with a forged message key and payload, enabling arbitrary message spoofing. The sa...
Fixed in 7.0.0-rc12; 6.7.22
SQL injection in Sequelize ORM (Oracle dialect) (CVE-2026-69240)
Sequelize's escape function in sql-string.js fails to escape single quotes in string values that begin with TO_TIMESTAMP or TO_DATE when the Oracle dialect is in use, returning the raw value instead. This allows an un...
Fixed in 6.37.4
Authentication bypass in libIEC61850 GOOSE frame parser (CVE-2026-52134)
A flaw in the parseGoosePayload() function in /goose/goose_receiver.c allows an attacker to bypass authentication by replaying or crafting a captured GOOSE frame. Successful exploitation may allow unauthorized control...
Fixed in 1.6.2
Remote code execution via unsanitized eval() in OpenEMR document category tree (CVE-2026-39932)
OpenEMR's Tree class (`library/classes/Tree.class.php`) constructs PHP code strings from database rows and passes them to an unsanitized `eval()` call when loading the document category tree. An authenticated administ...
Fixed in 8.3.0-dev
Lambda event spoofing via client-controlled header in @fastify/aws-lambda (CVE-2026-18248)
@fastify/aws-lambda 6.4.0 resolves the request.awsLambda.event and request.awsLambda.context decorations from the client-controllable x-apigateway-event and x-apigateway-context HTTP headers, which are not stripped fr...
Fixed in 6.4.1
Authentication bypass in SiYuan publish-mode password-protected documents (CVE-2026-68584)
SiYuan's publish mode enforces a password check on the primary `getDoc` endpoint via `FilterContentByPublishAccess`, but the endpoints `getHeadingChildrenDOM`, `getHeadingDeleteTransaction`, `getHeadingLevelTransactio...
Fixed in v3.7.3