Lucene search
+L

46025 matches found

ATTACKERKB
ATTACKERKB
added 2026/08/04 3:39 p.m.8 views

CVE-2026-69255

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...

9.2CVSS6AI score0.00313EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/08/04 3:28 p.m.14 views

CVE-2026-69254 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...

9.4CVSS5.8AI score
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/04 3:28 p.m.36 views

CVE-2026-69254 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...

9.4CVSS0.00362EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/04 3:16 p.m.17 views

CVE-2026-67195

Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval with only...

8.8CVSS0.01156EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/04 6:38 a.m.46 views

CVE-2026-67243

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...

8.6CVSS0.00301EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/04 12:0 a.m.13 views

EUVD-2025-210615

H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, and H3C NE36 Pro V100R002 contain multiple command injection vulnerabilities in the /api/esps request handler. The affected object interfaces...

9.8CVSS6AI score0.0224EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/08/04 12:0 a.m.1 views

PT-2026-67806

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description The CSVAgent component interpolates a segment of the csvFile data URI directly into a Python source-code template executed by Pyodide. Because Pyodide is loaded with a default JavaScript bridge to...

9.4CVSS5.8AI score0.00578EPSS
SaveExploits0References13
Tenable Nessus
Tenable Nessus
added 2026/08/04 12:0 a.m.13 views

RHEL 9 : sg3_utils (RHSA-2026:50141)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50141 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

7.6CVSS6AI score0.00247EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/03 9:16 p.m.11 views

CVE-2026-66065

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still...

8.4CVSS0.00297EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/08/03 8:33 p.m.8 views

CVE-2026-18733

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the noninteractive parameter to true, bypassing the human consent gate. To...

8.8CVSS6AI score0.00322EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/08/03 7:4 p.m.8 views

CVE-2026-67324

A flaw was found in GitPython. A remote attacker can exploit a vulnerability where the software fails to properly recognize joined short-option forms e.g., -u when enforcing its default unsafe-option gate. This allows the attacker to bypass security checks and execute arbitrary commands during a...

9.8CVSS7.6AI score0.00379EPSS
SaveExploits0References5
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/03 1:33 p.m.13 views

Malicious code in simple-date-formatter-util-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6c0d10eabca0cef05a136e2ffd68781a965747ad1e75bf9fd9528292bbe429 The package is advertised as a date-formatting utility but its package.json postinstall script curls cloud-provider instance metadata endpoints AWS...

5.6AI score
SaveExploits0References1
NVD
NVD
added 2026/08/03 1:17 p.m.12 views

CVE-2026-18574

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server MDS could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful...

9.3CVSS0.00991EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/03 12:7 p.m.13 views

EUVD-2026-52265

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server MDS could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful...

9.3CVSS6AI score0.00991EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/08/03 12:7 p.m.8 views

CVE-2026-18574 Authentication Bypass in Check Point Security Management Server

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server MDS could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful...

9.3CVSS6AI score0.00991EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/03 12:7 p.m.155 views

CVE-2026-18574

CVE-2026-18574 describes an authentication bypass in Check Point Security Management Server and Multi-Domain Security Management Server (MDS). Affected component: management services. Root cause: authentication bypass allowing an unauthenticated remote attacker with network access to execute arbi...

9.3CVSS6AI score0.00991EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/08/03 12:7 p.m.8 views

CVE-2026-18574

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server MDS could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful...

9.3CVSS6AI score0.00991EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/03 12:7 p.m.49 views

CVE-2026-18574 Authentication Bypass in Check Point Security Management Server

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server MDS could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful...

9.3CVSS0.00991EPSS
SaveExploits0References1
RedHat Linux
RedHat Linux
added 2026/08/03 3:49 a.m.7 views

mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine

A flaw was found in MariaDB server. When the CONNECT engine is installed and REST support is enabled on Windows, a user can exploit improper sanitization of the table HTTP attribute. This attribute is interpolated into the curl command line, allowing for arbitrary shell command execution on the...

9.9CVSS5.8AI score0.01334EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/08/03 12:0 a.m.29 views

PT-2026-67502

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the non interactive parameter to true, bypassing the human consent gate. To...

8.8CVSS6AI score0.00322EPSS
SaveExploits0References4
Rows per page
Query Builder