CVE-2026-77926

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/getanswer or upload documents with maliciou...

CVE-2026-109442

piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the execshell tool, which runs arbitrary commands via subprocess.run without human...

EUVD-2026-104686

Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/getanswer or upload documents with maliciou...

CVE-2026-109442 piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell

piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the execshell tool, which runs arbitrary commands via subprocess.run without human...

CVE-2026-109442

The piflow software versions 2.0.0 through 2.0.1 contain a remote code execution (RCE) vulnerability within the DeepAgents chat agent . The issue stems from a lack of authentication on the POST /chat and POST /chat/stream endpoints. An unauthenticated attacker can instruct the agent to invoke the...

EUVD-2026-104682

piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the execshell tool, which runs arbitrary commands via subprocess.run without human...