idor

Records39

1. closed6.0
   langchain4j-aideepin CVE-2026-125386: langchain4j-aideepin IDOR vulnerability in CharacterMessageController

   Patch now · Disclosed · since 10 Nov 2026 · CVE-2026-125386

   AI
2. closed7.1
   Dify Dify Insecure Direct Object Reference in MCP Server Endpoint

   Patch now · Disclosed · since 5 Oct 2026 · CVE-2026-105761

   AI
3. closed6.5
   Flowise CVE-2026-73488: Insecure direct object reference in Flowise customer endpoint

   Patch now · Disclosed · since 13 Aug 2026 · CVE-2026-73488

   AI
4. closed9.9
   Flowise CVE-2026-67622: Flowise IDOR vulnerability in OpenAI Assistants integration

   Patch now · Disclosed · since 6 Aug 2026 · CVE-2026-67622

   AI
5. closed
   Flowise Flowise IDOR vulnerability exposes payment and profile data

   Patch now · Disclosed · since 4 Aug 2026

   AI
6. closed7.1
   Flowise CVE-2026-70472: Flowise cross-workspace credential IDOR vulnerability

   Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70472

   AI
7. closed8.4
   Langflow Langflow IDOR Vulnerability Allows Unauthorized Flow Execution

   Patch now · Exploited · since 23 Jun 2026 · updated 23 Jun 2026 · CVE-2026-55255

   AI
8. closed4.3
   Open WebUI CVE-2026-54016: Open WebUI knowledge base file enumeration BOLA

   Patch now · Disclosed · since 17 Jun 2026 · updated 23 Jun 2026 · CVE-2026-54016

   AI
9. closed5.3
   Open WebUI CVE-2026-54022: Open WebUI authentication bypass leaks private notes

   Patch now · Disclosed · since 17 Jun 2026 · updated 23 Jun 2026 · CVE-2026-54022

   AI
10. closed4.3
    Open WebUI CVE-2026-54006: Open WebUI calendar event re-parenting IDOR vulnerability

    Patch now · Disclosed · since 17 Jun 2026 · updated 23 Jun 2026 · CVE-2026-54006

    AI
11. closed8.3
    Open WebUI CVE-2026-54010: Open WebUI forged chat-file link leads to file read and deletion

    Patch now · Disclosed · since 17 Jun 2026 · updated 23 Jun 2026 · CVE-2026-54010

    AI
12. closed6.4
    Open WebUI CVE-2026-54015: Open WebUI prompt history IDOR allows cross-prompt read and deletion

    Patch now · Disclosed · since 17 Jun 2026 · updated 23 Jun 2026 · CVE-2026-54015

    AI
13. closed8.8
    Langflow CVE-2026-33760: Langflow IDOR/BOLA in Monitor API

    Patch now · Disclosed · since 16 Jun 2026 · updated 23 Jun 2026 · CVE-2026-33760

    AI
14. closed6.1
    Langflow CVE-2026-48520: Langflow arbitrary local or S3 file read vulnerability

    Patch now · Disclosed · since 16 Jun 2026 · updated 23 Jun 2026 · CVE-2026-48520

    AI
15. closed7.5
    Langflow CVE-2026-7787: Authentication bypass vulnerability in IBM Langflow OSS

    Patch now · Disclosed · since 11 Jun 2026 · CVE-2026-7787

    AI
16. closed4.3
    Open WebUI CVE-2026-45386: Open WebUI IDOR Vulnerability in Message Pinning API

    Patch now · Disclosed · since 14 May 2026 · updated 15 May 2026 · CVE-2026-45386

    AI
17. closed6.5
    Open WebUI CVE-2026-45345: Open WebUI Authorization Bypass Vulnerability in Model Updates

    Patch now · Disclosed · since 14 May 2026 · updated 15 May 2026 · CVE-2026-45345

    AI
18. closed8.8
    Flowise CVE-2026-46477: FlowiseAI Mass Assignment Dataset Takeover

    Patch now · Disclosed · since 14 May 2026 · updated 8 Jun 2026 · CVE-2026-46477

    AI
19. closed4.3
    Open WebUI CVE-2026-45385: Open WebUI IDOR vulnerability in update_message_by_id endpoint

    Patch now · Disclosed · since 14 May 2026 · updated 15 May 2026 · CVE-2026-45385

    AI
20. closed7.5
    Open WebUI CVE-2026-45398: Open WebUI Retrieval API Access Control Bypass

    Patch now · Disclosed · since 14 May 2026 · updated 15 May 2026 · CVE-2026-45398

    AI
21. closed8.1
    Open WebUI CVE-2026-45402: Open WebUI Cross-User File Access Vulnerability

    Patch now · Disclosed · since 14 May 2026 · updated 15 May 2026 · CVE-2026-45402

    AI
22. closed6.5
    Open WebUI CVE-2026-45666: Open WebUI IDOR Vulnerability in User Notes

    Patch now · Disclosed · since 14 May 2026 · updated 15 May 2026 · CVE-2026-45666

    AI
23. closed7.7
    Flowise FlowiseAI CustomTemplate Mass Assignment Workspace Takeover

    Patch now · Disclosed · since 14 May 2026 · updated 8 Jun 2026 · CVE-2026-46476

    AI
24. closed8.8
    Flowise FlowiseAI Assistant Mass Assignment Workspace Takeover

    Patch now · Disclosed · since 14 May 2026 · updated 8 Jun 2026 · CVE-2026-46475

    AI
25. closed8.8
    Flowise FlowiseAI DatasetRow Mass Assignment Workspace Takeover

    Patch now · Disclosed · since 14 May 2026 · updated 8 Jun 2026 · CVE-2026-46478

    AI
26. closed8.1
    Open WebUI Open WebUI Missing Permission Check in Files API

    Patch now · Disclosed · since 14 May 2026 · updated 15 May 2026 · CVE-2026-45301

    AI
27. closed7.1
    Open WebUI CVE-2026-44569: Open WebUI insecure message access and authorization flaw

    Patch now · Disclosed · since 11 May 2026 · updated 15 May 2026 · CVE-2026-44569

    AI
28. closed4.3
    AnythingLLM CVE-2026-42456: Insecure direct object reference in AnythingLLM tts endpoint

    Patch now · Disclosed · since 8 May 2026 · CVE-2026-42456

    AI
29. closed6.5
    Dify CVE-2026-41950: Authorization bypass in Dify allows unauthorized file access

    Patch now · Disclosed · since 5 May 2026 · CVE-2026-41950

    AI
30. closed7.5
    Langflow CVE-2026-4503: IBM Langflow Desktop Insecure Direct Object Reference

    Patch now · Disclosed · since 30 Apr 2026 · CVE-2026-4503

    AI
31. closed6.5
    Langflow CVE-2026-6542: IBM Langflow OSS Unauthorized Data Access Vulnerability

    Patch now · Disclosed · since 30 Apr 2026 · CVE-2026-6542

    AI
32. closed8.8
    Flowise CVE-2026-41277: Flowise Mass Assignment Leads to Cross-Workspace Object Takeover

    Patch now · Disclosed · since 17 Apr 2026 · updated 23 Apr 2026 · CVE-2026-41277

    AI
33. closed3.1
    Open WebUI CVE-2026-29071: Open WebUI IDOR allows access to other users' memories

    Patch now · Disclosed · since 27 Mar 2026 · CVE-2026-29071

    AI
34. closed8.7
    Langflow CVE-2026-34046: Langflow IDOR Allows Unauthorized Flow Access

    Patch now · Disclosed · since 27 Mar 2026 · CVE-2026-34046

    AI
35. closed7.5
    Langflow Langflow unauthenticated IDOR vulnerability on image downloads

    Patch now · Disclosed · since 20 Mar 2026 · updated 24 Mar 2026 · CVE-2026-33484

    AI
36. closed7.1
    Langflow CVE-2026-33053: Langflow Missing Ownership Verification in API Key Deletion

    Patch now · Disclosed · since 18 Mar 2026 · updated 20 Mar 2026 · CVE-2026-33053

    AI
37. closed8.8
    Flowise CVE-2026-30823: Flowise IDOR and SSO Configuration Vulnerability

    Patch now · Disclosed · since 6 Mar 2026 · updated 7 Mar 2026 · CVE-2026-30823

    AI
38. closed3.7
    Lobe Chat CVE-2026-23522: Lobe Chat IDOR Vulnerability in Knowledge Base File Removal

    Patch now · Disclosed · since 20 Jan 2026 · CVE-2026-23522

    AI
39. closed6.5
    Open WebUI CVE-2024-7041: open-webui IDOR vulnerability allows editing memories

    Patch now · Disclosed · since 9 Oct 2024 · CVE-2024-7041

    AI