CVE-2026-90534

Flowise , a low-code platform for building LLM applications, is affected by a Cross-Workspace Credential IDOR in the POST /api/v1/node-load-method/:name endpoint through version 3.1.3 . The endpoint lacks route-level permission checks and resolves credentials by raw Credential.id via getCredentia...

EUVD-2026-76852

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

CVE-2026-0766

CVE-2026-0766: OpenWebUI Remote Code Execution Educational Security Research Repository This repository contains proof-of-concept exploitation code for CVE-2026-0766 , a remote code execution vulnerability in OpenWebUI discovered and published by the Zero Day Initiative ZDI. ⚠️ Disclaimer This...

Important: Red Hat Security Advisory: Red Hat Enterprise Linux AI 3.3.5

Updated Red Hat Enterprise Linux AI 3.3.5 container images are now available. Red Hat® Enterprise Linux® AI is a foundation model platform to seamlessly develop, test, and run Granite family large language models LLMs for enterprise applications. This update provides the latest Red Hat Enterprise...

LangGenius, Inc. Dify has an SSRF vulnerability (CNVD-C-2026-287908)

Dify is an open-source LLM application development platform. LangGenius, Inc. Dify has an SSRF vulnerability, which allows attackers to obtain sensitive information...

dify 跨站脚本漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A cross-site scripting vulnerability exists in versions prior to dify 1.1.3, which stems from uncleared input in the Firefox browser and could lead to cross-site scripting attacks...

CVE-2025-49149

Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting XSS attack when a user...