CVE-2025-3248

CVE-2025-3248 – Execute arbitrary Python code on vulnerable Langflow server. Discovered by: Naveen Sunkavally, Horizon3.ai Status: Public Disclosure Date Reported: 2025-04-07 CVE ID: CVE-2025-3248 🧾 Screenshot 🧩 Summary A critical flaw has been discovered in Langflow that allows malicious actors ...

CVE-2025-3248

CVE-2025-3248: Langflow Ejecución Remota de Código RCE Sin Autenticación Este repositorio contiene dos scripts de Python: LangflowCheck.py: Un escáner que verifica instancias de Langflow AI vulnerables a CVE-2025-3248. exploit.py: Un exploit funcional de reverse shell para objetivos Langflow...

Linux Distros Unpatched Vulnerability : CVE-2026-104851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0,...

CVE-2026-33017-PoC-Reverse-Shell

CVE-2026-33017 - Exploit de RCE no autenticado en Langflow 📋 Descripción general CVE-2026-33017 es una vulnerabilidad de Ejecución Remota de Código RCE no autenticada en versiones de Langflow Este exploit es solo para fines educativos y de pruebas autorizadas. El acceso no autorizado a sistemas...

CVE-2026-33017

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote Code Execution PoC ★ https://github.com/user-attachments/assets/562fc637-6be1-4ab9-a396-bfad56447af7 Configuración del Entorno Utiliza los siguientes comandos para construir y ejecutar el entorno vulnerable de Langflow: docker build -t...

CentOS Linux 7 [TuxCare] Security Update: python-jinja2 (CENTOS7:CLSA-2025:1765310613)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1765310613 advisory. - Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allow...

CVE-2026-51857

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary...

CVE-2026-51857

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary...

CVE-2026-51857

The camel-ai camel library (versions v0.2.91a1 , v0.2.91a2 , and v0.2.91a3 ) contains a vulnerability where the CodeExecutionToolkit can execute Python code produced by a model via the SubprocessInterpreter without an approval boundary . This lack of control over generated code execution (CWE-94)...

Wazuh - Unsafe Deserialization Remote Code Execution

A critical Remote Code Execution RCE vulnerability exists in Wazuh server versions = 4.4.0 and = 4.4.0 and 4.9.1. The vulnerability occurs due to unsafe deserialization in the wazuh-manager package, specifically in the DistributedAPI where parameters are serialized as JSON and deserialized using...

EUVD-2026-87829

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...

CVE-2026-100864

The heym library (versions prior to 0.0.91 ) contains a sandbox escape vulnerability within the expression engine 's DotList map/filter and fallback resolver. This flaw allows authenticated users to execute arbitrary Python code by crafting workflow expressions that use dunder attribute access . ...

Linux Distros Unpatched Vulnerability : CVE-2026-79310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that...

DEBIAN-CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

UBUNTU-CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-79310: Improper Control of Generation of Code

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...