Security advisories

critical2026-04-16

CVE-2026-6270-@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

fastify/middie · GHSA-72c6-fx6q-fr5w

high2026-04-16

CVE-2026-33804-@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

fastify/middie · GHSA-v9ww-2j6r-98q6

high2026-04-16

CVE-2026-41276-Flowise: resetPassword Authentication Bypass Vulnerability

flowiseai/flowise · GHSA-f6hc-c5jr-878p

high2026-04-16

CVE-2026-41274-Flowise: Cypher Injection in GraphCypherQAChain

flowiseai/flowise · GHSA-28g4-38q8-3cwc

high2026-04-16

CVE-2026-41275-Flowise: Password Reset Link Sent Over Unsecured HTTP

flowiseai/flowise · GHSA-x5w6-38gp-mrqh

high2026-04-16

CVE-2026-41273-Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in Flowise

flowiseai/flowise · GHSA-6f7g-v4pp-r667

high2026-04-16

CVE-2026-41271-Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains

flowiseai/flowise · GHSA-6r77-hqx7-7vw8

high2026-04-16

CVE-2026-41272-Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)

flowiseai/flowise · GHSA-2x8m-83vc-6wv4

high2026-04-16

CVE-2026-41270-Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox

flowiseai/flowise · GHSA-xhmj-rg95-44hv

high2026-04-16

CVE-2026-41269-Flowise: File Upload Validation Bypass in createAttachment

flowiseai/flowise · GHSA-rh7v-6w34-w2rr

high2026-04-16

CVE-2026-41268-Flowise: Parameter Override Bypass Remote Command Execution

flowiseai/flowise · GHSA-cvrr-qhgw-2mm6

high2026-04-16

CVE-2026-41266-Flowise: Sensitive Data Leak in public-chatbotConfig

flowiseai/flowise · GHSA-4jpm-cgx2-8h37

high2026-04-16

CVE-2026-41267-Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association

flowiseai/flowise · GHSA-48m6-ch88-55mj

critical2026-04-16

CVE-2026-41137-Flowise: Code Injection in CSVAgent leads to Authenticated RCE

flowiseai/flowise · GHSA-9wc7-mj3f-74xv

high2026-04-16

CVE-2026-41138-Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.

flowiseai/flowise · GHSA-f228-chmx-v6j6

medium2026-04-16

CVE-2026-41413-Istio: SSRF via RequestAuthentication jwksUri

istio/istio · GHSA-fgw5-hp8f-xfhc

high2026-04-16

CVE-2026-41324-basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()

patrickjuchli/basic-ftp · GHSA-rp42-5vxx-qpwr

high2026-04-16

Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak)

kyverno/kyverno · GHSA-8wfp-579w-6r25

high2026-04-16

CVE-2026-41323-Kyverno: ServiceAccount token leaked to external servers via apiCall service URL

kyverno/kyverno · GHSA-f9g8-6ppc-pqq4

high2026-04-16

CVE-2026-41068-Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)

kyverno/kyverno · GHSA-cvq5-hhx3-f99p