CVE-2026-85172

n8n versions before 2.34.1 contain a server-side request forgery (SSRF) vulnerability in the legacy request helper function exposed to Code and Function nodes. The root cause is a mismatch between validation and execution: the SSRF check inspects the uri property, while the underlying HTTP client...

Flowise < 3.1.2 - node-custom-function Unauthorized RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

EUVD-2026-35110

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

EUVD-2023-27107

Malicious code in bioql PyPI...

Insufficient Type Distinction

Overview skops is an A set of tools to push scikit-learn based models to and pull from Hugging Face Hub Affected versions of this package are vulnerable to Insufficient Type Distinction via inconsistent validation in the OperatorFuncNode class in the io/audit.py file. An attacker can execute...

CVE-2023-23007

An issue was discovered in ESPCMS P8.21120101 after logging in to the background, there is a SQL injection vulnerability in the function node where members are added...