Path Traversal

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Path Traversal via improper validation of the user-supplied chatflowid identifier in the addBase64FilesToStorage function. An attacker can access or modify arbitrary files, execute code, or...

Directory Traversal

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Directory Traversal via improper validation of the chatId parameter in the file access process. An attacker can access sensitive files on the server filesystem, including database files...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via the convertToValidJSONString function. An attacker can execute arbitrary JavaScript code with full server privileges by supplying malicious input to the...

flowise (>=1.6.1, <=1.8.4) potentially affected by CVE-2025-59527 via flowise-components (1.8.6)

flowise-components NPM version 1.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on flowise-components and may be impacted: - flowise =1.6.1, =1.8.4 Source cves: CVE-2025-59527 Source advisory: SNYK:JS-FLOWISECOMPONENTS-12840076...

Server-side Request Forgery (SSRF)

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fetch function in the fetch-links feature when user-supplied URLs are not validated. An attacker can access internal network resources and sensitive...

flowise (>=1.6.1, <=1.8.4) potentially affected by unknown CVE via flowise-components (1.8.6)

flowise-components NPM version 1.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on flowise-components and may be impacted: - flowise =1.6.1, =1.8.4 Source cves: unknown CVE Source advisory: SNYK:JS-FLOWISECOMPONENTS-12818395...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via the supabaseRPCFilter parameter. An attacker with administrative privileges can execute arbitrary server-side code, access sensitive environment variables, and...

CVE-2025-10220

Use of Unmaintained Third Party Components CWE-1104 in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a remote attacker to execute arbitrary code or bypass security features via exploitation of vulnerable third-party packages such as...

BIT-NIFI-2023-34212 Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location...

CVE-2025-23343

The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to write files to restricted components. A successful exploit of this vulnerability may lead to information disclosure, denial of service, and data tampering...

DEBIAN-CVE-2025-39739

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-qcom: Add SM6115 MDSS compatible Add the SM6115 MDSS compatible to clients compatible list, as it also needs that workaround. Without this workaround, for example, QRB4210 RB2 which is based on SM4250/SM6115...

mysql: Components Services unspecified vulnerability (CPU Apr 2025)

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service DoS...

Malicious code in @self-sell/components (npm)

The package @self-sell/components was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aeb15f4ae1c1a830e2fdc21bd8a903fe2e14978eb9952f1e5b3f98f0ca7f353f Any computer that has this package installed or running should be considered fully...

Malware in @navancorp/angular-web-components

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview @navancorp/angular-web-components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malware in @self-sell/components

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-47044 Malicious code in @self-sell/components (npm)

The package @self-sell/components was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aeb15f4ae1c1a830e2fdc21bd8a903fe2e14978eb9952f1e5b3f98f0ca7f353f Any computer that has this package installed or running should be considered fully...

Malicious code in @navancorp/ta-fe-components (npm)

The package @navancorp/ta-fe-components was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea9ac90aa6a85cd2ff704d7ebf6928a5015a78c68b643de047583737e115a088 Any computer that has this package installed or running should be considered...

Malware in @navancorp/ta-fe-components

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

ALSA-2025:15699 Moderate: mysql-selinux and mysql8.4 security update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon mysqld and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fixes: openssl:...