Security advisories

critical2026-08-04

CVE-2026-69251-Flowise RCE via TypeORM DataSource

flowiseai/flowise · GHSA-g32j-mmxr-gfq5

high2026-08-04

CVE-2026-69250-Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

flowiseai/flowise · GHSA-r745-8hwv-h473

medium2026-08-04

Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint

flowiseai/flowise · GHSA-2364-jh4q-m9vm

medium2026-08-03

CVE-2026-69248-python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

pyca/cryptography · GHSA-m2h6-j472-rp4c

high2026-08-03

CVE-2026-69249-python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

pyca/cryptography · GHSA-jwv3-5hgf-82ww

high2026-08-03

CVE-2026-69247-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

pyca/cryptography · GHSA-g6cj-pr64-35w5

high2026-08-03

CVE-2026-69246-Guzzle: Noncanonical host can bypass host-based checks

guzzle/guzzle · GHSA-v5mv-p594-2x33

medium2026-08-03

CVE-2026-69245-Guzzle: Noncanonical cookie domain keeps subdomain scope

guzzle/guzzle · GHSA-f7vp-7xgx-4w4r

high2026-08-03

CVE-2026-69244-AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

aio-libs/aiohttp · GHSA-cq5v-8q36-5273

medium2026-08-03

CVE-2026-69243-AIOHTTP: HTTP request smuggling via WebSocket upgrade

aio-libs/aiohttp · GHSA-mfx4-hv73-q22v

medium2026-08-03

CVE-2026-59881-AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

aio-libs/aiohttp · GHSA-mq44-7p77-q5h7

critical2026-08-03

CVE-2026-69240-Sequelize: SQL Injection (Oracle DB)

sequelize/sequelize · GHSA-v8fg-2rw7-q452

medium2026-08-03

CVE-2026-69207-Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

honojs/hono · GHSA-8j4g-w8fx-2239

medium2026-08-03

GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count

gitpython-developers/gitpython · GHSA-p538-c434-8v24

medium2026-08-03

GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()

gitpython-developers/gitpython · GHSA-539m-9xh6-q6rr

high2026-08-03

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

gitpython-developers/gitpython · GHSA-3f7w-8rr8-f37f

high2026-08-03

CVE-2026-69192-ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

beaugunderson/ip-address · GHSA-mwp4-54f8-5fhr

medium2026-08-03

CVE-2026-69198-ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

beaugunderson/ip-address · GHSA-4xrf-jv44-h6hh

medium2026-08-03

CVE-2026-54272-ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

beaugunderson/ip-address · GHSA-22jq-vg5j-6vgg

medium2026-08-03

CVE-2026-15157-undici vulnerable to CRLF Injection via blob-like body 'type' property

nodejs/undici · GHSA-m8rv-5g2x-5cg5