CVE Notifier

CVE-2026-91933 CWE-639 7.1

Flowise before 3.1.4 Authorization Bypass via openai-realtime

Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from ChatFlows in other workspaces by supplying an unscoped chatflowid…

cve.org FlowiseAI:Flowise 15 Sep 2026

CVE-2026-91932 CWE-20 8.5

Flowise before 3.1.4 Remote Code Execution via cwd Parameter

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validatio…

cve.org FlowiseAI:Flowise · FlowiseAI:Flowise 15 Sep 2026

CVE-2026-91931 CWE-78 8.5

Flowise before 3.1.4 Remote Code Execution via Custom MCP npx

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. At…

cve.org FlowiseAI:Flowise · FlowiseAI:Flowise 15 Sep 2026

CVE-2026-91930 CWE-266 7.5

Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organiz…

cve.org FlowiseAI:Flowise 15 Sep 2026

CVE-2026-91929 CWE-862 7.1

Flowise before 3.1.4 Cross-Tenant Authorization Bypass

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise access can delete arbitrary workspaces, in…

cve.org FlowiseAI:Flowise 15 Sep 2026

CVE-2024-58384 CWE-113 5.4

Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values…

cve.org tornadoweb:tornado 15 Sep 2026

CVE-2024-14029 CWE-444 7.5

Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when T…

cve.org tornadoweb:tornado 15 Sep 2026

CVE-2023-54397 CWE-444 7.5

Tornado before 6.3.3 HTTP Request Smuggling via Content-Length

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to…

cve.org tornadoweb:tornado 15 Sep 2026

CVE-2026-54077 CWE-22 7.1

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its s…

cve.org ArcadeData:arcadedb · com.arcadedb:arcadedb-engine 15 Sep 2026

CVE-2026-54076 CWE-862 8.1

ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/ma…

cve.org ArcadeData:arcadedb · com.arcadedb:arcadedb-engine 15 Sep 2026

CVE-2026-91848 CWE-89 7.3

WuzhiCMS index.php getDataOfJson sql injection

A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson. The manipulation of the argument title/mas…

cve.org n/a:WuzhiCMS 15 Sep 2026

CVE-2026-55828 CWE-22 N/A

qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extrac…

cve.org qbee-io:transport 15 Sep 2026