Security advisories

high2026-05-14

CVE-2026-46444-FlowiseAI: Vector Store No Permission Checks

flowiseai/flowise · GHSA-hmg2-jjjx-jcp2

medium2026-05-14

CVE-2026-45076-Synapse pagination Denial of Service

element-hq/synapse · GHSA-6qf2-7x63-mm6v

high2026-05-14

CVE-2026-45078-Synapse CPU starvation (Denial of Service)

element-hq/synapse · GHSA-8q93-326v-3m7g

high2026-05-14

CVE-2026-45732-n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints

n8n-io/n8n · GHSA-6h4j-wcr9-2vg7

high2026-05-14

CVE-2026-44792-n8n Has a Source Control Pull SQL Injection

n8n-io/n8n · GHSA-mhrx-qhrj-673w

critical2026-05-14

CVE-2026-44791-n8n Has an XML Node Prototype Pollution Patch Bypass

n8n-io/n8n · GHSA-wrwr-h859-xh2r

critical2026-05-14

CVE-2026-44790-n8n Has an Arbitrary File Read via Git Node

n8n-io/n8n · GHSA-57g9-58c2-xjg3

critical2026-05-14

CVE-2026-44789-n8n: HTTP Request Node Pagination Prototype Pollution to RCE

n8n-io/n8n · GHSA-c8xv-5998-g76h

medium2026-05-14

CVE-2026-44722-pyzipper has an encryption bypass for small files encrypted using it

danifus/pyzipper · GHSA-crqm-m339-7m2p

high2026-05-14

CVE-2026-43978-wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager

wger-project/wger · GHSA-9qpr-vc49-hqg2

high2026-05-14

CVE-2026-43977-wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API

wger-project/wger · GHSA-cj9g-27ph-4cgv

medium2026-05-14

CVE-2026-42853-@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input

apostrophecms/apostrophe · GHSA-hcwq-x9fw-8cfq

medium2026-05-14

CVE-2026-43644-podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints

stefanprodan/podinfo · GHSA-q23m-vm9r-5745

high2026-05-14

CVE-2026-46443-FlowiseAI Vulnerable to Credential Data Leak

flowiseai/flowise · GHSA-7g73-99r4-m4mj

critical2026-05-14

CVE-2026-46442-FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

flowiseai/flowise · GHSA-9rvc-vf7m-pgm2

high2026-05-14

CVE-2026-46441-FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment

flowiseai/flowise · GHSA-hp26-q66v-q2w7

high2026-05-14

Flowise has an MCP Security Bypass that Enables RCE

flowiseai/flowise · GHSA-m99r-2hxc-cp3q

high2026-05-14

CVE-2026-46440-FlowiseAI Exposes Basic Auth Credentials via API

flowiseai/flowise · GHSA-php6-83fg-gw3g

high2026-05-14

CVE-2026-42863-FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment

flowiseai/flowise · GHSA-5wxp-qjgq-fx6m

high2026-05-14

CVE-2026-42862-FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment

flowiseai/flowise · GHSA-x5v6-pj28-cwwm