https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T01:59:29.214775+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-368124 EUVD-2026-368124 2026-10-04T01:59:29.261264+00:00 EUVD-2026-368124 https://cve.radiocsirt.org/vuln/fkie_cve-2026-90533 fkie_cve-2026-90533 2026-10-04T01:59:29.261300+00:00

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with any user ID to obtain the owner's credential hash for offline cracking, enabling account takeover of the highest-privileged account.

 https://cve.radiocsirt.org/vuln/ghsa-hwr2-69f4-g9h6 GHSA-hwr2-69f4-g9h6 2026-10-04T01:59:29.261349+00:00

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with any user ID to obtain the owner's credential hash for offline cracking, enabling account takeover of the highest-privileged account.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3326 WID-SEC-W-2026-3326 — Flowise: Mehrere Schwachstellen 2026-10-04T01:59:29.261368+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen, was weitere Angriffe ermöglicht.