Skip to content
OpenAdvisories

Archive

8 August 2026

Vulnerabilities first published on this day (UTC), newest first.

1 result · Clear filters · Feed

  • High 7.7
    CVE-2026-67620 Public exploit

    Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List

    Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoin…