Flowise 3.1.4 IDOR in OpenAI Assistants Integration

CVE-2026-67622

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration th

历史摘要 · 未重新核验 · OSV.dev

PHP_CodeSniffer gitblame report command injection via crafted filename

CVE-2026-67434

### Impact PHP_CodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code cre

历史摘要 · 未重新核验 · GitHub Advisory

PHP_CodeSniffer gitblame report command injection via crafted filename

CVE-2026-67434

PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.

历史摘要 · 未重新核验 · OSV.dev

Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints

CVE-2026-67621

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perf

历史摘要 · 未重新核验 · OSV.dev

OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN

CVE-2026-48086

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · OSV.dev

OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap

CVE-2026-48085

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · OSV.dev

node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

CVE-2026-71498

## Summary `re2` infers a character's byte length from its UTF-8 lead byte alone, with no bound on the bytes actually r

历史摘要 · 未重新核验 · GitHub Advisory

node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

CVE-2026-71498

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final byt

历史摘要 · 未重新核验 · OSV.dev

Frappe: Lack of Permissions in restore/bulk_restore

CVE-2026-47765

Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints

历史摘要 · 未重新核验 · OSV.dev

node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

CVE-2026-71430

## Description `WrappedRE2::Replace` builds the replacement result and hands it to V8 with `.ToLocalChecked()` **withou

历史摘要 · 未重新核验 · GitHub Advisory

node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

CVE-2026-71430

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function

历史摘要 · 未重新核验 · OSV.dev

Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain

CVE-2026-47194

Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation c

历史摘要 · 未重新核验 · OSV.dev

OpenReception doesn't rate limit passphrase login attempts

CVE-2026-48084

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions pri

历史摘要 · 未重新核验 · OSV.dev

OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification

CVE-2026-48082

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · OSV.dev

ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

ngx-extended-pdf-viewer embeds a fork of Mozilla's pdf.js rather than depending on pdfjs-dist, so this vulnerability is

历史摘要 · 未重新核验 · GitHub Advisory

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

CVE-2026-16633

### Impact If PDF.js is used to load a malicious PDF, and PDF.js is configured with `enableScripting` set to true (whic

历史摘要 · 未重新核验 · GitHub Advisory

OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer

CVE-2026-48081

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · OSV.dev

jsoup: Cleaner may expose markup with custom raw-text elements

CVE-2026-71497

When a custom `Safelist` permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a t

历史摘要 · 未重新核验 · GitHub Advisory

jsoup: Cleaner may expose markup with custom raw-text elements

CVE-2026-71497

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectl

历史摘要 · 未重新核验 · OSV.dev

Frappe Has Broken Access Control in its Workspace Save API

CVE-2026-47185

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspac

历史摘要 · 未重新核验 · OSV.dev