49460 matches found
PT-2026-67906
Summary Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis which on Node.js exposes eval and dynamic import, the...
CVE-2026-70478: Exposure of Sensitive Information to an Unauthorized Actor
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELISTURLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh...
AI Forensics across White-, Grey-, and Black-Box Access: A Process Model and Research Agenda for Post-Incident Investigation of AI Systems
AI systems are increasingly involved in decisions and actions that may later require investigation. When an AI related incident occurs, investigators need to reconstruct what the system did, why it behaved that way, and which part of the system or supply chain contributed to the outcome. Existing...
CVE-2025-15673
creationtimestamp| type| source ---|---|--- 2026-08-03 23:34:48+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3ms7nxyas4w2m...
CVE-2026-18684
creationtimestamp| type| source ---|---|--- 2026-08-03 23:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7mazaa2b2p 2026-08-04 03:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/117035003364698464 2026-08-04 03:00:32+00:00| seen|...
CVE-2026-48333
creationtimestamp| type| source ---|---|--- 2026-08-03 23:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7m5hjbyy2u 2026-08-04 06:00:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117035710843679491 2026-08-04 06:00:27+00:00| seen|...
CVE-2026-48331
creationtimestamp| type| source ---|---|--- 2026-08-03 23:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7lzvvkyb2p 2026-08-04 02:22:22+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3ms7xdm562k2s 2026-08-04 02:50:19+00:00| seen|...
CVE-2026-48330
creationtimestamp| type| source ---|---|--- 2026-08-03 22:58:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7lwd2mby2u 2026-08-04 00:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms7pgf3mdc2x 2026-08-06 16:16:07+00:00| seen|...
ctf-writeups
🏴 CTF Writeups & PoC Collection Documented solutions from Hac...
CVE-2026-48326
creationtimestamp| type| source ---|---|--- 2026-08-03 22:58:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7lwbt4qi2o 2026-08-04 00:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms7pg6e2tw2p 2026-08-04 17:10:53+00:00| seen|...
CVE-2026-18667
creationtimestamp| type| source ---|---|--- 2026-08-03 22:56:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7lsrh6kl2h 2026-09-04 22:20:22+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mupyqdlqjs2b...
CVE-2026-46713
creationtimestamp| type| source ---|---|--- 2026-08-03 22:56:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7lsq36if2b...
CVE-2026-18641
creationtimestamp| type| source ---|---|--- 2026-08-03 22:15:12+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3ms7jjnkh3h24...
CVE-2026-48113 Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection
Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against...
CVE-2026-48113
The CVE-2026-48113 entry concerns Chisel, a TCP/UDP tunnel over SSH, where ACL restrictions provided by --authfile are bypassed on post-handshake SSH channels. Authenticated clients can open channels to arbitrary host:port destinations reachable from the server because ACL checks are performed on...
CVE-2026-48113 Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection
Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against...
CVE-2026-48113 Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection
Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against...
CVE-2026-69240
creationtimestamp| type| source ---|---|--- 2026-08-03 21:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7fkh4ivf2h 2026-08-03 22:00:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms7iowh6z32g 2026-08-03 22:35:08+00:00|...
CVE-2026-18108
creationtimestamp| type| source ---|---|--- 2026-08-03 21:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7fdcwaxk22 2026-08-03 23:11:10+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117034101614868174 2026-08-03 23:11:16+00:00| seen|...