jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-93448 via lfx (>=1.10.0, <=1.12.0.dev10)

lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-93674 via lfx (>=1.10.0, <=1.12.0.dev10)

lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-103360 via lfx (>=1.10.0, <=1.12.0.dev10)

lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-104334 via lfx (>=1.10.0, <=1.12.0.dev10)

lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-101861 via lfx (>=1.10.0, <=1.12.0.dev10)

lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...

adala (>=0.0.3, <=0.0.4), agent-actors (0.1.0) +42 more potentially affected by CVE-2026-10812 via gptcache (>=0.1.29.1, <=0.1.44)

gptcache PYPI version =0.1.29.1, =0.0.3, =0.0.5, =0.1.3, =0.28.9rc1, =0.13.0, =0.3.1, =0.1.48, =0.1.120a1, =0.1.120, =0.0.2, =0.5.17.post1, =0.6.0a2 and more Source cves: CVE-2026-10812 Source advisory: OSV:PYSEC-2026-3468...

Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs

An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more steps, and the same app is running commands on the PC driving the agent. Researchers demonstrated that chain, plus six...

arxiv-bot (>=0.0.5, <=0.0.6), langchain-utils (>=0.3.18, <=0.3.24) +3 more potentially affected by CVE-2026-55443 via langchain (0.0.141)

langchain PYPI version 0.0.141 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - arxiv-bot =0.0.5, =0.3.18, =0.1.0, =1.0.1, =0.0.1, =0.0.6 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

arxiv-bot (>=0.0.1, <=0.0.4), wanna (0.1.0) potentially affected by CVE-2026-55443 via langchain (0.0.96)

langchain PYPI version 0.0.96 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - arxiv-bot =0.0.1, =0.0.4 - wanna 0.1.0 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

arxiv-bot (>=0.0.5, <=0.0.6), langchain-utils (>=0.3.18, <=0.3.24) +3 more potentially affected by CVE-2026-55443 via langchain (0.0.141)

langchain PYPI version 0.0.141 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - arxiv-bot =0.0.5, =0.3.18, =0.1.0, =1.0.1, =0.0.1, =0.0.6 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models

University of Toronto researchers have built and tested a proof-of-concept AI-driven computer worm that uses a locally hosted open-weight large language model to reason its way through a network, generate tailored attack strategies for each target it encounters, and replicate itself, all without...

CVE-2026-43995

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients node-fetch, axios instead of using the secured wrapper. These tools include 1 OpenAPIToolkit/OpenAPIToolkit.ts, 2...

CVE-2026-43995 Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients node-fetch, axios instead of using the secured wrapper. These tools include 1 OpenAPIToolkit/OpenAPIToolkit.ts, 2...

CVE-2026-43995 Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients node-fetch, axios instead of using the secured wrapper. These tools include 1 OpenAPIToolkit/OpenAPIToolkit.ts, 2...

CVE-2026-43995

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients node-fetch, axios instead of using the secured wrapper. These tools include 1 OpenAPIToolkit/OpenAPIToolkit.ts, 2...

EUVD-2025-21457

Malicious code in bioql PyPI...

CVE-2025-50819

Directory traversal vulnerability in beiyuouo arxiv-daily thru 2025-05-06 commit fad168770b0e68aef3e5acfa16bb2e7a7765d687 when parsing the the topic.yml file in the generation logic in dailyarxiv.py...

CVE-2025-50819

Directory traversal vulnerability in beiyuouo arxiv-daily thru 2025-05-06 commit fad168770b0e68aef3e5acfa16bb2e7a7765d687 when parsing the the topic.yml file in the generation logic in dailyarxiv.py...

CVE-2025-50819

Directory traversal vulnerability in beiyuouo arxiv-daily thru 2025-05-06 commit fad168770b0e68aef3e5acfa16bb2e7a7765d687 when parsing the the topic.yml file in the generation logic in dailyarxiv.py...

PT-2025-29568 · Unknown · Beiyuouo Arxiv-Daily

Name of the Vulnerable Software and Affected Versions: beiyuouo arxiv-daily versions through 2025-05-06 commit fad168770b0e68aef3e5acfa16bb2e7a7765d687 Description: A directory traversal vulnerability exists when parsing the topic.yml file in the generation logic within daily arxiv.py...