7754 matches found
CVE-2026-45100
OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the s.b64encode string transformation. The size check for s.b64encode only verifies that the input fits within the 64 KB transformation buffer, but...
UBUNTU-CVE-2026-45100
OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the s.b64encode string transformation. The size check for s.b64encode only verifies that the input fits within the 64 KB transformation buffer, but...
Malicious code in entropyeasybots (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa index.js decodes a base64-obfuscated IP 85.137.253.124 and connects a spawned /bin/sh subprocess's stdio to a TCP socket at 85.137.253.124:1111,...
MAL-2026-11539 Malicious code in entropyeasybots (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa index.js decodes a base64-obfuscated IP 85.137.253.124 and connects a spawned /bin/sh subprocess's stdio to a TCP socket at 85.137.253.124:1111,...
EUVD-2026-52975
OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the s.b64encode string transformation. The size check for s.b64encode only verifies that the input fits within the 64 KB transformation buffer, but...
CVE-2026-45100 OpenSIPS: Buffer Overflow in Base64 Encode Transformation
OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the s.b64encode string transformation. The size check for s.b64encode only verifies that the input fits within the 64 KB transformation buffer, but...
CVE-2026-45100 OpenSIPS: Buffer Overflow in Base64 Encode Transformation
OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the s.b64encode string transformation. The size check for s.b64encode only verifies that the input fits within the 64 KB transformation buffer, but...
CVE-2026-45100 OpenSIPS: Buffer Overflow in Base64 Encode Transformation
OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the s.b64encode string transformation. The size check for s.b64encode only verifies that the input fits within the 64 KB transformation buffer, but...
CVE-2026-45100
OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the s.b64encode string transformation. The size check for s.b64encode only verifies that the input fits within the 64 KB transformation buffer, but...
CVE-2026-70552
MaxSite CMS
CVE-2026-70552 MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php
MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any -ajax.php file in the codebase...
CVE-2026-70552 MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php
MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any -ajax.php file in the codebase...
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
Summary Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis which on Node.js exposes eval and dynamic import, the...
NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
CVE-2026-69264
Flowise CSVAgent is affected. Prior to 3.1.3, an attacker-controlled segment of csvFile’s data URI is interpolated into a Python source-template executed by Pyodide; due to the default js bridge to globalThis in Node.js, this can be passed to js.eval and dynamically import Node built-ins (e.g., f...
CVE-2026-69264 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...
Arbitrary Code Injection
Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via unsanitized string interpolation in the CSVAgent process. An attacker can execute arbitrary operating system commands, read sensitive files, steal credentials, an...
Arbitrary Code Injection
Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via unsanitized string interpolation in the CSVAgent process. An attacker can execute arbitrary operating system commands, read sensitive files, steal credentials, and cause denial ...