PT-2026-73091

Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.2.5 Description This is a second-order SQL Injection issue where an attacker can append additional SQL queries to existing ones to extract sensitive database information. The...

CVE-2026-15602: Improper Neutralization of Special Elements used in an SQL Command

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

...

EUVD-2026-58545

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

CVE-2026-19751

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

CVE-2026-19751 EnzoVezzaro mcp-dominican-layer parse-csv tool index.ts axios.get server-side request forgery

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

CVE-2026-19751

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

CVE-2026-19751

CVE-2026-19751 affects EnzoVezzaro mcp-dominican-layer (parse-csv tool). The flaw resides in src/index.ts, where axios.get is invoked with a manipulated csvUrl, enabling server-side request forgery. Exploitation is remote and a PoC exploit has been published. The project uses a rolling release st...

CVE-2026-19751 EnzoVezzaro mcp-dominican-layer parse-csv tool index.ts axios.get server-side request forgery

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

CVE-2026-72898 vulnerabilities

Vulnerabilities for packages: metabase...

Duplicate Advisory: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w7x8-q2gp-5cgg. This link is maintained to preserve external references. Original Description Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows...

GHSA-X3JW-7GJ7-QV6M Duplicate Advisory: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w7x8-q2gp-5cgg. This link is maintained to preserve external references. Original Description Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows...

CVE-2026-73486

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...

CVE-2026-73486 Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...

CVE-2026-73487

Flowise prior to version 3.1.3 is affected by a vulnerability in the CSV and Airtable Agent nodes where a regex-based Python code validator bypass enables unauthenticated prompt injection. This can allow an attacker to inject and execute code, exfiltrate datasets via unblocked pandas functions (e...

CVE-2026-73487 Flowise before 3.1.3 Prompt Injection RCE via CSV Agent

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.readjson to exfiltrate datasets, perform SSRF...

CVE-2026-73487 Flowise before 3.1.3 Prompt Injection RCE via CSV Agent

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.readjson to exfiltrate datasets, perform SSRF...

EUVD-2026-57802

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...

CVE-2026-73486

CVE-2026-73486 (Flowise) : Flowise versions before 3.1.3 contain a code injection vulnerability in the CSV Agent node’s customReadCSV parameter. An authenticated attacker can trigger arbitrary Python code execution by bypassing a static regex blocklist used for validation, enabling code execution...

CVE-2026-73486 Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...