CVE-2026-90534

Flowise , a low-code platform for building LLM applications, is affected by a Cross-Workspace Credential IDOR in the POST /api/v1/node-load-method/:name endpoint through version 3.1.3 . The endpoint lacks route-level permission checks and resolves credentials by raw Credential.id via getCredentia...

EUVD-2026-76852

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

CVE-2026-0766

CVE-2026-0766: OpenWebUI 원격 코드 실행 교육용 보안 연구 저장소 이 저장소는 ZDIZero Day Initiative 가 발견하고 공개한 OpenWebUI의 원격 코드 실행 취약점인 CVE-2026-0766 에 대한 개념 증명PoC 악용 코드를 포함하고 있습니다. ⚠️ 면책 조항 이 저장소는 승인된 보안 테스트 및 교육 목적으로만 사용됩니다. 이 코드는 자신의 시스템 또는 테스트에 대한 명시적 승인 을 받은 시스템에서만 사용하십시오. LLM 플랫폼 보안 취약점에 대한 학습 목적으로만 사용하십시오. ❌ 명시적...

Important: Red Hat Security Advisory: Red Hat Enterprise Linux AI 3.3.5

Updated Red Hat Enterprise Linux AI 3.3.5 container images are now available. Red Hat® Enterprise Linux® AI is a foundation model platform to seamlessly develop, test, and run Granite family large language models LLMs for enterprise applications. This update provides the latest Red Hat Enterprise...

LangGenius, Inc. Dify has an SSRF vulnerability (CNVD-C-2026-287908)

Dify is an open-source LLM application development platform. LangGenius, Inc. Dify has an SSRF vulnerability, which allows attackers to obtain sensitive information...

dify 跨站脚本漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A cross-site scripting vulnerability exists in versions prior to dify 1.1.3, which stems from uncleared input in the Firefox browser and could lead to cross-site scripting attacks...

CVE-2025-49149

Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting XSS attack when a user...