All CVEs — page 442 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• MEDIUM 5.4CVE-2026-100630public exploit available2026-09-26
• MEDIUM 5.5CVE-2026-100629public exploit available2026-09-26
• MEDIUM 4.3CVE-2026-100628public exploit available2026-09-26
• HIGH 8.1CVE-2026-100627public exploit available2026-09-26

  The flaw allows an attacker with app-level permissions to promote a bundle to a channel where a per-channel deny override exists, bypassing intended restrictions.

• MEDIUM 4.3CVE-2026-100626public exploit available2026-09-26
• HIGH 7.1CVE-2026-100625public exploit available2026-09-26
• MEDIUM 5.4CVE-2026-100624public exploit available2026-09-26
• HIGH 8.8CVE-2026-100623public exploit available2026-09-26

  This flaw allows an authenticated admin to bypass the normal membership workflow and directly add any user as an admin in their organization, potentially granting unauthorized access.

• HIGH 7.5CVE-2026-100622public exploit available2026-09-26

  The capgo.app service fails to properly verify if cached bundle artifacts have been deleted before serving them, allowing unauthenticated attackers to download deleted content and trigger restoration of those objects in R2 storage.

• MEDIUM 4.3CVE-2026-100621public exploit available2026-09-26
• LOW 3.8CVE-2026-100620public exploit available2026-09-26
• HIGH 8.8CVE-2026-100619public exploit available2026-09-26

  The flaw allows an attacker with certain API keys or write permissions to inject malicious files into the manifest, potentially leading to OTA manifest poisoning.

• HIGH 8.5CVE-2026-100618public exploit available2026-09-26

  The flaw allows an authenticated user with an app-limited write API key to rewrite an out-of-scope private image object, potentially impacting organization logos or other sensitive images.

• HIGH 8.8CVE-2026-100617public exploit available2026-09-26

  The flaw allows authenticated app/org admins to grant channel permissions to non-member users, enabling attackers with admin privileges to bypass organization membership checks and grant unauthorized access.

• MEDIUM 5.5CVE-2026-100616public exploit available2026-09-26
• HIGH 8.8CVE-2026-100615public exploit available2026-09-26

  The flaw allows an apikey_manager to rotate a higher-privileged org_super_admin API key, leading to credential recovery. This matters because it enables privilege escalation and unauthorized access.

• HIGH 8.8CVE-2026-100614public exploit available2026-09-26

  The flaw allows an authenticated attacker to modify metadata in cross-tenant image objects by supplying known victim keys, bypassing storage access controls.

• MEDIUM 5.3CVE-2026-100613public exploit available2026-09-26
• HIGH 7.2CVE-2026-100612public exploit available2026-09-26
• MEDIUM 6.5CVE-2026-100611public exploit available2026-09-26
• HIGH 7.5CVE-2026-100610public exploit available2026-09-26

  Flowise allows authenticated users to read and delete upsert history data from other users and workspaces by exploiting missing permission checks on API endpoints that accept attacker-controlled identifiers. This creates a privilege escalation vulnerability where low-privilege users can access sensitive configuration data and potentially manipulate document storage operations.

• MEDIUM 6.8CVE-2026-100609public exploit available2026-09-26
• HIGH 8.3CVE-2026-100608public exploit available2026-09-26

  The flaw allows any authenticated user to access and manipulate the BullMQ admin dashboard, viewing and modifying sensitive data across the entire instance.

• HIGH 7.7CVE-2026-100607public exploit available2026-09-26

  The flaw allows attackers to authenticate as any existing user by claiming their email at any configured SSO provider, gaining complete account access.

• HIGH 7.7CVE-2026-100606public exploit available2026-09-26

  Flowise version 3.1.4 allows an attacker to bypass authentication by using a pending invitee's email address through an SSO callback, gaining access to the organization without needing the invitation token.