CVE-2026-0766

CVE-2026-0766：OpenWebUI 远程代码执行 教育性安全研究仓库 本仓库包含针对 CVE-2026-0766 的概念验证利用代码，这是由 零日计划（ZDI） 发现并公开的 OpenWebUI 远程代码执行漏洞。 ⚠️ 免责声明 本仓库仅用于授权的安全测试和教育目的。 使用此代码测试您自己的系统 或您拥有明确授权 进行测试的系统 将此用于学习 LLM 平台安全漏洞相关知识 ❌ 切勿 在未经明确许可的情况下针对任何系统使用此代码 ❌ 未经授权访问计算机系统是违法行为 作者不对滥用此代码的行为承担任何责任。用户须自行确保其活动符合所有适用的法律法规。 📋 漏洞概述 属性| 值...

CVE-2026-90534

Flowise , a low-code platform for building LLM applications, is affected by a Cross-Workspace Credential IDOR in the POST /api/v1/node-load-method/:name endpoint through version 3.1.3 . The endpoint lacks route-level permission checks and resolves credentials by raw Credential.id via getCredentia...

CVE-2026-90534 Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

EUVD-2026-76852

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

Important: Red Hat Security Advisory: Red Hat Enterprise Linux AI 3.3.5

Updated Red Hat Enterprise Linux AI 3.3.5 container images are now available. Red Hat® Enterprise Linux® AI is a foundation model platform to seamlessly develop, test, and run Granite family large language models LLMs for enterprise applications. This update provides the latest Red Hat Enterprise...

LangGenius, Inc. Dify has an SSRF vulnerability (CNVD-C-2026-287908)

Dify is an open-source LLM application development platform. LangGenius, Inc. Dify has an SSRF vulnerability, which allows attackers to obtain sensitive information...

dify 跨站脚本漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A cross-site scripting vulnerability exists in versions prior to dify 1.1.3, which stems from uncleared input in the Firefox browser and could lead to cross-site scripting attacks...

CVE-2025-49149

Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting XSS attack when a user...