flowintel

Every one of the 14 is a mark on the map. Named now: 1 to 14, most at risk first.

1. Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram ContentCVE-2026-81753flowintel · CVSS 5.1 · 0.5% likely

   CWE-79

2. Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration KeysCVE-2026-81662flowintel · CVSS 8.6 · 0.5% likely

   CWE-94

3. Stored Cross-Site Scripting via Vue Template Injection in FlowIntelCVE-2026-69075flowintel · CVSS 6.9 · 0.5% likely

   CWE-79

4. Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task AssignmentsCVE-2026-81819flowintel · CVSS 5.3 · 0.5% likely

   CWE-862

5. Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX ProcessingCVE-2026-81659flowintel · CVSS 7.1 · 0.5% likely

   CWE-22

6. Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email InputCVE-2026-81827flowintel · CVSS 6.9 · 0.4% likely

   CWE-20

7. Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template InjectionCVE-2026-81743flowintel · CVSS 7.5 · 0.4% likely

   CWE-22

8. Flowintel Fails to Invalidate Active Sessions After Password ChangeCVE-2026-81826flowintel · CVSS 9.1 · 0.4% likely

   CWE-384

9. Flowintel Stored XSS in Calendar via Malicious Case TitleCVE-2026-81814flowintel · CVSS 5.1 · 0.4% likely

   CWE-79

10. Flowintel HTML Injection in MISP Case History Timeline via Crafted Object AttributesCVE-2026-81820flowintel · CVSS 5.1 · 0.4% likely

    CWE-79

11. Flowintel Organization Administrator Can Reset Full Administrator Password and Escalate PrivilegesCVE-2026-81818flowintel · CVSS 8.6 · 0.4% likely

    CWE-269

12. Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task ModificationCVE-2026-81817flowintel · CVSS 7.2 · 0.4% likely

    CWE-639

13. FlowIntel external reference URL probe allows server-side request forgeryCVE-2026-9813flowintel · CVSS 6.2 · 0.2% likely

    CWE-918

14. SQL Injection in Database Migration via Stored Connector Identifiers in flowintelCVE-2026-124850flowintel · CVSS 7.3 · 0.1% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.