CVE-2026-69263

Flowise (pre-3.1.3) is affected by CVE-2026-69263. The root cause is that npm_config_yes can bypass the environment-variable block on the MCP feature, allowing npx to auto-install and execute a named package when a Custom MCP server is launched. This creates a path to unauthenticated remote code ...

CVE-2026-69263 Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LDLIBRARYPATH, DYLDLIBRARYPATH, and NODEOPTIONS by exact...

CVE-2026-69100

LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the scrip...

CVE-2026-69259 Flowise RCE via SQLite Record Manager Node

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended...

CVE-2026-69259

Summary: CVE-2026-69259 affects Flowise (SQLite Record Manager node) prior to 3.1.3. The vulnerability arises from user-controlled additionalConfig in SQLiteRecordManager.ts, which could overwrite the SQLite database path, allowing an authenticated attacker using a published Docker image (running...

GHSA-X3HF-7CJ6-3R4M Flowise RCE via SQLite Record Manager Node

============================================================================= Security Advisory elttam Topic: Flowise RCE via SQLite Record Manager Node Module: FlowiseAI/Flowise Disclosed: 24-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2 I. Background Flowise AI is an open-source...

Flowise RCE via SQLite Record Manager Node

============================================================================= Security Advisory elttam Topic: Flowise RCE via SQLite Record Manager Node Module: FlowiseAI/Flowise Disclosed: 24-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2 I. Background Flowise AI is an open-source...

NPM: Flowise RCE via SQLite Record Manager Node

NPM: Flowise RCE via SQLite Record Manager Node vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

EUVD-2026-52761

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...

EUVD-2026-52755

A vulnerability allowing remote unauthenticated code execution on the agent host...

CVE-2026-58072

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...

CVE-2026-58072

CVE-2026-58072 : The vulnerability affects the Veeam Service Provider Console. It enables arbitrary file write on the management server, which can lead to remote code execution. The CVSS v4.0 score is 9.0 (CRITICAL) with network attack vector, no user interaction, and high impacts on confidential...

CVE-2026-64633

A vulnerability allowing remote unauthenticated code execution on the agent host...

EUVD-2026-52747

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CVE-2026-15307

CVE-2026-15307 affects Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups cast the right-hand side of a filter to a GDALRaster, and any value (including untrusted input) is opened for writing or treated as a datasource, enabling a file to be written with an attacker-chosen n...

CVE-2026-15307 Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

Flowise: Remote Code Execution Vulnerability in CSVAgent

Summary The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to utilise the pandas library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, panda...

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...