CVE-2026-91932

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working...

CVE-2026-91931

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code ...

CVE-2026-19407

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution RCE and tenant-project token theft...

Exploit for Code Injection in Langflow

CVE-2026-17633 & CVE-2026-17632 — IBM Langflow OSS RCE Fo...

CVE-2026-19780 Koha Eval Code Injection Remote Code Execution Vulnerability

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

Exploit for Path Traversal in Fckeditor

CVE-2009-2265 - Adobe ColdFusion RCE Unauthenticated remote c...

Malicious code in strapi-plugin-plsresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae27e46ab1160942d8d569f2237b9890a5f0a2cac36171ced091678c2a876c44 The package's postinstall lifecycle script runs a bash reverse shell that opens a TCP connection to the hardcoded host 14.225.210.85 on port 443 and...

Vulnerabilities exist in Apple macOS and Samba systems, developed by Apple and Samba.

Apple has identified several vulnerabilities in macOS specifically related to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. These vulnerabilities include heap-based buffer overflows, use-after-free errors, integer overflows, null pointer dereferences, improper access control, privilege escalation...

CVE-2026-19407 GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution RCE and tenant-project token theft...

CVE-2026-91988 atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by...

CVE-2026-91988 atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by...

CVE-2026-91963 FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when...

CVE-2026-91963 FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when...

EUVD-2026-78792

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...

CVE-2026-91934 Flowise before 3.1.4 Remote Code Execution via SQL Database Chain

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...

CVE-2026-91934 Flowise before 3.1.4 Remote Code Execution via SQL Database Chain

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...

CVE-2026-91934

Flowise versions before 3.1.4 are affected by an insufficient path validation vulnerability in the SQL Database Chain node when connecting to SQLite databases. The flaw allows authenticated attackers to write arbitrary files to the filesystem by crafting file paths in SQLite connection parameters...

CVE-2026-91932 Flowise before 3.1.4 Remote Code Execution via cwd Parameter

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working...

CVE-2026-91932 Flowise before 3.1.4 Remote Code Execution via cwd Parameter

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working...

CVE-2026-91931 Flowise before 3.1.4 Remote Code Execution via Custom MCP npx

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code ...