CVE Vulnerability Catalog

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. An attacker can add themselves as organization owners, create workspaces, and gain administrative access to victim organizations.

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. An attacker with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse stored SSO secrets.

A vulnerability was identified in WuzhiCMS up to 4.1.0 in the article::getDataOfJson function of /index.php?m=content&f=article&v=getDataOfJson. Manipulation of the title/master_table arguments leads to SQL injection. The exploit is publicly available and can be used remotely.

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality intended for authorized administrators.

The "Design Scuole Italia" WordPress theme is affected by multiple authorization bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed at /circolare/feed/ further facilitates exploitation.

A path traversal vulnerability exists in the reserved_file_check function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process.

A flaw was found in environment-modules. A local attacker can place a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name containing shell metacharacters is evaluated as a command.

ArcadeDB prior to 26.7.1 allows a reader-role user to submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, analyze, and registerFunctions do not enforce database-administrator authorization. GraalPolyglotEngine also permits scripts to bypass the allowedPackages whitelist by reflecting from the bound database object to arbitrary host classes.

In mcp-from-openapi (2.3.0–2.5.0) and frontmcp and @frontmcp/adapters (1.2.1–1.5.0), loadOpenAPISpec() forwards untrusted OpenAPI URLs and inputs to the tool generator without proper destination validation. The external $ref guard only checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirects, or normalizing IPv4-mapped IPv6. An authenticated user able to import an OpenAPI specification can force requests to internal services.

The @jhb.software/payload-alt-text-plugin version 0.7.0 for Payload CMS exposes POST /api/alt-text-plugin/generate and /bulk endpoints with a default guard accepting any authenticated user. The req.payload.findByID and req.payload.update calls do not set overrideAccess: false, so Payload defaults to skipping the collection's access functions. An authenticated low-privilege user can read protected documents and overwrite their alt and keywords fields.

In Docker MCP Gateway from 0.21.0 until 0.42.2, the attacker-controlled io.docker.server.metadata OCI image label was unmarshalled into the catalog.Server structure for docker:// references and catalog snapshot imports. Runtime-shaping fields including Volumes, User, and ExtraHosts were appended to the docker run arguments without an origin allowlist. A malicious image author can force host filesystem or Docker socket mounts and UID 0 execution.

In GeoNetwork prior to 4.2.17 and 4.4.12, the POST /api/tools/ogc/sld endpoint accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server send requests to internal hosts not publicly reachable. When the response was XML, the endpoint could store and return the fetched body.

In ArcadeDB prior to 26.6.1, the IMPORT DATABASE statement did not require administrative privileges and passed its source to the importer without validation. An authenticated user with SQL command access via /api/v1/command or /api/v1/query can supply HTTP/HTTPS destinations to make server-side requests to internal services, or file:// paths to read files accessible to the server process and ingest them as records. The XML importer also permits DTD processing and external entities.

In ArcadeDB prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, leaving the remaining public schema mutators in LocalDocumentType.java and LocalProperty.java unchecked. An authenticated identity, including a read-only API token without UPDATE_SCHEMA permission, can use DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY through the HTTP endpoints to rename types, change inheritance, alter aliases or buckets, drop properties, and change property constraints.

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft.

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling.

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.

The MotoPress Hotel Booking plugin for WordPress in all versions up to and including 6.2.4 is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' due to insufficient input sanitization and output escaping. The premium Stripe webhook listener only verifies the webhook signature when an optional Stripe signing secret has been configured; because that secret is empty by default, a forged webhook is accepted without cryptographic verification, and the attacker-controlled event object 'id' is written unescaped into the payment log and later echoed unsanitized when an administrator views the payment.

Denial-of-service vulnerability in the integrated web server of Hirschmann HiOS Switch Platform devices. A remote unauthenticated attacker can send a specially crafted HTTP(S) request to a specific endpoint that is processed incorrectly, causing an unintended reboot and temporary denial of service. The issue is fixed in versions 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08, and 10.5.00.

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components.