appflowy-io appflowy-cloud vulnerabilities in 2026, newest first
Filter
By year: all 2026 2025 2024 2023 2022 2021
- 5.1CVE-2026-127203EPSS 0.2%
AppFlowy Cloud through 0.9.64 contains a stored cross-site scripting vulnerability that allows authenticated workspace members to upload blobs with unvalidated Content-Type values that are later served inline without a Content-Disposition …
- 7.1CVE-2026-88898EPSS 0.4%
AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published v…
- 6.0CVE-2026-85622EPSS 0.4%
AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Atta…
- 7.7CVE-2026-85619EPSS 0.6%
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with…
- 7.1CVE-2026-16007EPSS 0.3%
AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.