CVE-2026-56275 Flowise - Server-Side Request Forgery via Execute Flow Base URL

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...

CVE-2026-56275 Flowise - Server-Side Request Forgery via Execute Flow Base URL

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...

CVE-2026-56275

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...

EUVD-2026-38435

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...

Malicious code in libsignal-node-travatiger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 311b53330c1d8c3546d0b4fa3d460ca694fc20d60608ac5a276f40f7a73279fa On require of this package, index.js schedules install.js which locates @whiskeysockets/baileys in the installer's nodemodules tree searching...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver-fips, crossplane-provider-aws-cloudtrail-fips, go-getter, grafana-mimir-fips, kubernetes-csi-driver-nfs-fips, octo-sts, dataplaneapi-fips, volcano, crossplane-provider-aws-lambda, tbot, seaweedfs, dapr-fips, k8ssandra-client-fips,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver-fips, crossplane-provider-aws-cloudtrail-fips, go-getter, grafana-mimir-fips, kubernetes-csi-driver-nfs-fips, octo-sts, dataplaneapi-fips, volcano, crossplane-provider-aws-lambda, tbot, seaweedfs, dapr-fips, k8ssandra-client-fips,...

CVE-2026-12151 vulnerabilities

Vulnerabilities for packages: prism, renovate, node-gyp, kibana, py3-captum, code-server, actions-runner, npm, pelias-api, saf, gemini-cli, vitess, haraka...

CVE-2026-11525 vulnerabilities

Vulnerabilities for packages: prism, renovate, node-gyp, kibana, py3-captum, code-server, actions-runner, npm, pelias-api, saf, gemini-cli, vitess, haraka...

CVE-2026-9679 vulnerabilities

Vulnerabilities for packages: prism, renovate, node-gyp, kibana, py3-captum, code-server, actions-runner, npm, pelias-api, saf, gemini-cli, vitess, haraka...

GHSA-G8M3-5G58-FQ7M vulnerabilities

Vulnerabilities for packages: prism, renovate, node-gyp, kibana, py3-captum, code-server, actions-runner, npm, pelias-api, saf, gemini-cli, vitess, haraka...

GHSA-P88M-4JFJ-68FV vulnerabilities

Vulnerabilities for packages: prism, renovate, node-gyp, kibana, py3-captum, code-server, actions-runner, npm, pelias-api, saf, gemini-cli, vitess, haraka...

CVE-2026-6733 vulnerabilities

Vulnerabilities for packages: prism, renovate, node-gyp, kibana, py3-captum, code-server, actions-runner, npm, pelias-api, saf, gemini-cli, vitess, haraka...

GHSA-35P6-XMWP-9G52 vulnerabilities

Vulnerabilities for packages: prism, renovate, node-gyp, kibana, py3-captum, code-server, actions-runner, npm, pelias-api, saf, gemini-cli, vitess, haraka...

CVE-2026-49261

A flaw was found in MariaDB server. When the wsrepnotifycmd feature is enabled, a remote attacker could exploit this vulnerability by embedding shell commands in the name of a joiner node. This could lead to arbitrary code execution on the server, allowing the attacker to take full control of the...

MAL-2026-6278 Malicious code in ts-wross (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42dae43b7ff77748f10ae5faf6d87b7d63552e5629a37c931ea2c0de3539b469 Package is published under the name ts-wross but its package.json claims authorship by Michael Mclaughlin [email protected] and points its repository...

Malicious code in node-core-libs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d33f74e3f73fd5580ecf994b7db0349ee540754d65d4467b8b04b8c79e3d257b scripts/postinstall.js runs automatically on npm install Windows only and behaves as a classic install-time dropper. It XOR-decodes key 0x5A a...

MAL-2026-6276 Malicious code in node-core-libs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d33f74e3f73fd5580ecf994b7db0349ee540754d65d4467b8b04b8c79e3d257b scripts/postinstall.js runs automatically on npm install Windows only and behaves as a classic install-time dropper. It XOR-decodes key 0x5A a...

Linux Distros Unpatched Vulnerability : CVE-2026-53655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar node-tar applies a PAX extended header's size= record and other PAX overrides to the next head...

PT-2026-51508

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0 Description A server-side request forgery SSRF issue exists in the Execute Flow node. This occurs due to missing secureFetch verification in httpSecurity.ts, allowing attackers to bypass security validation by...