73484 matches found
CVE-2026-10032
The CVE-2026-10032 issue involves the openUrl function in @a2ui/web_core, which passes an agent-controlled URL directly to window.open() without URI scheme validation. A malicious actor can supply a javascript: URI as the url argument for a Button component’s functionCall action, allowing arbitra...
NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
EUVD-2026-52742
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...
CVE-2026-69254
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...
CVE-2026-69251
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...
GHSA-WG86-R78F-74MP Flowise Sandbox Escape to RCE
============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm...
Flowise Sandbox Escape to RCE
============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm...
CLSA-2026-1785468077 TuxCare security update for protobufjs (7 CVEs)
TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 5.0.0-tuxcare.2...
CLSA-2026-1780534264 TuxCare security update for jspdf (12 CVEs)
TuxCare rebuilt jspdf to address 12 CVEs. Fixed in 2.5.1-tuxcare.1...
CLSA-2026-1776645372 TuxCare security update for serialize-javascript (1 CVE)
TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 5.0.1-tuxcare.2...
CLSA-2026-1776645371 TuxCare security update for serialize-javascript (1 CVE)
TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 6.0.2-tuxcare.2...
CLSA-2026-1776213251 TuxCare security update for serialize-javascript (3 CVEs)
TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 2.1.2-tuxcare.1...
CLSA-2026-1774916713 TuxCare security update for serialize-javascript (1 CVE)
TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 3.1.0-tuxcare.1...
CLSA-2026-1774916711 TuxCare security update for serialize-javascript (1 CVE)
TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 5.0.1-tuxcare.1...
CLSA-2026-1774916712 TuxCare security update for serialize-javascript (1 CVE)
TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 4.0.0-tuxcare.1...
CLSA-2026-1774225180 TuxCare security update for uglify-js (2 CVEs)
TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 1.3.5-tuxcare.1...
CLSA-2026-1774398069 TuxCare security update for serialize-javascript (3 CVEs)
TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 1.9.1-tuxcare.1...