CVE-2026-30824 Flowise: Missing Authentication on NVIDIA NIM Endpoints

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router /api/v1/nvidia-nim/ is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generati...

CVE-2026-30824 Flowise: Missing Authentication on NVIDIA NIM Endpoints

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router /api/v1/nvidia-nim/ is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generati...

CVE-2026-30824

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router /api/v1/nvidia-nim/ is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generati...

CVE-2026-30824 Flowise: Missing Authentication on NVIDIA NIM Endpoints

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router /api/v1/nvidia-nim/ is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generati...

CVE-2026-30824

Flowise prior to 3.0.13 has a missing-auth issue on the NVIDIA NIM endpoints under /api/v1/nvidia-nim/* due to whitelisting in the global authentication middleware. This allows unauthenticated access to privileged functionality such as token generation and container management, enabling an attack...

Flowise Access Control Vulnerability

Flowise is an open-source tool developed by FlowiseAI, designed for easily building LLM applications. Prior versions of Flowise 3.0.13 contained an access control vulnerability. This vulnerability stemmed from the inclusion of NVIDIA NIM routers in the global authentication middleware whitelist,...

CVE-2026-30824: Missing Authentication for Critical Function

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router /api/v1/nvidia-nim/ is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generati...

Missing Authentication for Critical Function

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the WHITELISTURLS configuration, which allows unauthenticated access to privileged endpoints under /api/v1/nvidia-nim/. An attacker can obtain valid NVIDIA A...

GHSA-5F53-522J-J454 Flowise Missing Authentication on NVIDIA NIM Endpoints

Missing Authentication on NVIDIA NIM Endpoints Summary The NVIDIA NIM router /api/v1/nvidia-nim/ is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. Vulnerability Details | Field | Value |...

NVUE Interface Privilege Escalation

The vulnerability of the NVUE interface in NVIDIA Cumulus Linux and Operating System NVOS systems is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

PT-2026-23790

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.13 Description Flowise has an issue where the NVIDIA NIM router endpoint '/api/v1/nvidia-nim/' was incorrectly whitelisted in the global authentication middleware. This allowed unauthenticated access to sensitive...

NVUE Interface Privilege Escalation

The vulnerability of the NVUE interface in NVIDIA Cumulus Linux and Operating System NVOS systems is related to privilege assignment errors. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

NVUE Interface Privilege Escalation

The vulnerability of the NVUE interface in NVIDIA Cumulus Linux and Operating System NVOS systems is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow attackers to enhance their privileges...

Amazon Linux 2023 : cuda-toolkit-13 (ALAS2023NVIDIA-2026-276)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023NVIDIA-2026-276 advisory. NVIDIA Nsight Systems contains a vulnerability in the gfxhotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string to the processnsysrepcli.py script if...

Amazon Linux 2023 : cuda (ALAS2023NVIDIA-2026-277)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023NVIDIA-2026-277 advisory. NVIDIA Nsight Systems contains a vulnerability in the gfxhotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string to the processnsysrepcli.py script if...

aiqtoolkit (>=1.1.0a20251020, <=1.5.0a20260122), aiqtoolkit-agno (>=1.3.0, <=1.3.1) +41 more potentially affected by CVE-2025-45691 via ragas (>=0.2.6, <=0.2.15)

ragas PYPI version =0.2.6, =1.1.0a20251020, =1.3.0, =1.1.0a20250506, =1.3.0, =1.1.0a20251020, =1.3.0, =1.3.0, =2.8.1, =1.0.0, =1.1.0a20251020, =1.4.0a20251206, =1.1.0a20251020, =1.1.0a20251020, =1.4.0a20260106, =1.5.0a20260211, =1.5.0a20260218 and more Source cves: CVE-2025-45691 Source advisory:...

aiqtoolkit (>=1.1.0a20251020, <=1.5.0a20260122), aiqtoolkit-agno (>=1.3.0, <=1.3.1) +41 more potentially affected by CVE-2025-45691 via ragas (>=0.2.6, <=0.2.15)

ragas PYPI version =0.2.6, =1.1.0a20251020, =1.3.0, =1.1.0a20250506, =1.3.0, =1.1.0a20251020, =1.3.0, =1.3.0, =2.8.1, =1.0.0, =1.1.0a20251020, =1.4.0a20251206, =1.1.0a20251020, =1.1.0a20251020, =1.4.0a20260106, =1.5.0a20260211, =1.5.0a20260218 and more Source cves: CVE-2025-45691 Source advisory:...

Important: cuda-toolkit-13-1

Issue Overview: NVIDIA Nsight Systems contains a vulnerability in the gfxhotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string to the processnsysrepcli.py script if the script is invoked manually. A successful exploit of this vulnerability might lea...

Ubuntu: Security Advisory (USN-8060-5)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

NVIDIA Delegated Licensing Service Authorization Issues Vulnerability

NVIDIA Delegated Licensing Service is a licensing service of NVIDIA Corporation. NVIDIA Delegated Licensing suffers from an authorization issue vulnerability that stems from improper authentication, which can be exploited by an attacker to cause information disclosure...