CVE-2026-73487: Improper Control of Generation of Code

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.readjson to exfiltrate datasets, perform SSRF...

EUVD-2026-58030

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

CVE-2026-72676: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...

CVE-2026-73485: Improper Control of Generation of Code

Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the...

CVE-2026-67986

The amazing-print/amazing_print gem (commit dc890dfafdf07088ea901df53c19c2710e5c5234 ) is vulnerable to Ruby code injection within the AwesomeMethodArray#grep method. The root cause is that a specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constr...

PT-2026-71425

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description A code injection issue exists in the Airtable Agent node. Unauthenticated attackers can execute arbitrary Python code by using obfuscation techniques to bypass the pythonCodeValidator blocklist. By...

PT-2026-71426

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description Authenticated attackers can execute arbitrary Python code via the customReadCSV parameter in the CSV Agent node. The issue stems from a validator that relies on a static regex blocklist, which can be...

CVE-2026-73486: Improper Control of Generation of Code

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...

Linux Distros Unpatched Vulnerability : CVE-2026-18408

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the...

CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

CVE-2026-13433

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 ACS is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation...

GHSA-WP74-JGXH-GV4Q vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

Arbitrary Code Injection

Overview @prompty/core is a Prompty core package Affected versions of this package are vulnerable to Arbitrary Code Injection via the NunjucksRenderer in nunjucks.ts, which passes user-controlled inputs directly to env.renderString without restricting member access or function calls within the...

Malicious Package

Overview @years19/n8n-nodes-utils-helper-f is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview @years19/n8n-nodes-utils-helper-c is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview @years20/n8n-nodes-utils-helper-f is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview internallibv392 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview msaidccomtw is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview yangming8 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @years18/n8n-nodes-utils-helper-c is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...