CVE-2025-3248

CVE-2025-3248: تنفيذ التعليمات البرمجية عن بُعد RCE غير المصادق عليه في Langflow يحتوي هذا المستودع على سكربتين بلغة بايثون: LangflowCheck.py: ماسح ضوئي يتحقق من مثيلات Langflow AI المعرضة لثغرة CVE-2025-3248. exploit.py: استغلال shell عكسي يعمل ضد أهداف Langflow المعرضة للخطر. ملخص CVE-2025-3248...

CVE-2025-3248

توثيق أداة استغلال الثغرة CVE-2025-3248 مقدمة هذه الأداة مُصمَّمة لاستغلال الثغرة CVE-2025-3248 ثغرة حقن كود Python، من خلال إنشاء حمولة ضارة payload لتحقيق تنفيذ أوامر عن بُعد RCE على الخادم الهدف. توجد الثغرة في واجهة برمجة تطبيقات API لتطبيق ويب معين، حيث يمكن للمهاجم استغلال نقطة تنفيذ كود غي...

w3af

w3af - Web Application Attack and Audit Framework w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. The scanner is able to identify 200+ vulnerabilities, including Cross-Site...

CVE-2025-0868

Rapport de projet de test d'intrusion : Exploitation de CVE-2025-0868 RCE DocsGPT via JSON Eval 1. Introduction Une faille critique d'exécution de code à distance RCE CVE-2025-0868 a été divulguée le 20 février 2025 dans la bibliothèque open-source DocsGPT, causée par une utilisation dangereuse d...

CVE-2026-33017-Langflow-RCE

CVE-2026-33017 - Langflow RCE भेद्यता द्वारा शोषित infrar3d यह प्रूफ-ऑफ-कॉन्सेप्ट एक्सप्लॉइट Langflow के 1.9.0 से पहले के संस्करणों में एक गंभीर रिमोट कोड निष्पादन RCE भेद्यता को लक्षित करता है। यह भेद्यता अप्रमाणित हमलावरों को फ्लो बिल्डिंग API एंडपॉइंट के माध्यम से दुर्भावनापूर्ण Python कोड...

CVE-2025-3248

CVE-2025-3248 – Выполнение произвольного кода Python на уязвимом сервере Langflow. Обнаружено: Naveen Sunkavally, Horizon3.ai Статус: Публичное раскрытие Дата сообщения: 2025-04-07 ID CVE: CVE-2025-3248 🧾 Скриншот 🧩 Краткое описание Критическая уязвимость была обнаружена в Langflow, которая...

hexora

hexora Hexora è uno strumento di analisi statica progettato per rilevare pattern dannosi e nocivi nel codice Python. Combina un motore di analisi statica basato su regole con un modello di machine learning che assegna un punteggio ai file sorgente per classificarli come dannosi o benigni. Può...

EUVD-2026-53580

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code...

Wazuh - Unsafe Deserialization Remote Code Execution

A critical Remote Code Execution RCE vulnerability exists in Wazuh server versions = 4.4.0 and = 4.4.0 and 4.9.1. The vulnerability occurs due to unsafe deserialization in the wazuh-manager package, specifically in the DistributedAPI where parameters are serialized as JSON and deserialized using...

Security Bulletin: Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Summary Langflow OSS supports Agentic Assistant generated components and user-supplied custom Python components for workflow development. Weaknesses in code security scanning, runtime validation, custom component execution paths, and trusted code enforcement could allow authenticated users to...

Exploit for Eval Injection in Langflow

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote...

CVE-2026-18287

Aeon loadtimeseriessegmentationbenchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

CVE-2026-34789

A flaw was found in FreeCAD, a 3D parametric modeler. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted FCStd document. When the document is restored, attacker-controlled module attributes are processed, leading to the execution of arbitrary...

CVE-2026-34398

A flaw was found in FreeCAD, a 3D parametric modeler. The BIM Project Manager's Load Template function does not properly validate certain properties within a project template. This vulnerability allows a remote attacker to embed malicious Python code into a specially crafted BIM project template...

Linux Distros Unpatched Vulnerability : CVE-2026-59894

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in...

DEBIAN-CVE-2026-34399

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable...

DEBIAN-CVE-2026-34398

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval,...

CVE-2026-73485

Flowise before version 3.1.3 contains a code injection vulnerability in the Airtable Agent node that lets unauthenticated attackers bypass the pythonCodeValidator blocklist via obfuscation and inject malicious Python code. The injected code can run in an unsandboxed pyodide environment with full ...

EUVD-2026-57800

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like tocsv, tojson, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesyste...

DEBIAN-CVE-2026-73233

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a...