Lucene search
+L

263629 matches found

CVE
CVE
added 2 hours ago7 views

CVE-2026-15307

CVE-2026-15307 affects Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups cast the right-hand side of a filter to a GDALRaster, and any value (including untrusted input) is opened for writing or treated as a datasource, enabling a file to be written with an attacker-chosen n...

8.8CVSS5.8AI score
SaveExploits0References7
Cvelist
Cvelist
added 2 hours ago6 views

CVE-2026-15307 Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

8.8CVSS
SaveExploits0References7
Patchstack
Patchstack
added 3 hours ago3 views

NPM: Remote Code Execution Vulnerability in CSVAgent

NPM: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise versions = 3.1.2...

9.4CVSS5.6AI score
SaveExploits0References2Affected Software1
Patchstack
Patchstack
added 3 hours ago3 views

NPM: Remote Code Execution Vulnerability in CSVAgent

NPM: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

9.4CVSS5.6AI score
SaveExploits0References2Affected Software1
Patchstack
Patchstack
added 3 hours ago2 views

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

9.2CVSS5.7AI score
SaveExploits0References5Affected Software1
Patchstack
Patchstack
added 3 hours ago2 views

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

9.2CVSS5.7AI score
SaveExploits0References5Affected Software1
Patchstack
Patchstack
added 3 hours ago4 views

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

9.4CVSS5.4AI score
SaveExploits0References5Affected Software1
Cvelist
Cvelist
added 3 hours ago7 views

CVE-2026-69254 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...

9.4CVSS
SaveExploits0References4
CVE
CVE
added 3 hours ago7 views

CVE-2026-69100

The CVE entry covers LAMP Rapid Development Platform up to version 5.6.2, where a flaw in GlueFactory allows unsandboxed Groovy scripts stored in database template fields to run without compilation restrictions or whitelisting. An attacker can modify or influence the script field via message temp...

8.8CVSS6.8AI score
SaveExploits0References3
EUVD
EUVD
added 3 hours ago5 views

EUVD-2026-52741

LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the scrip...

8.8CVSS6.8AI score
SaveExploits0References3
Cvelist
Cvelist
added 3 hours ago6 views

CVE-2026-69100 LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution

LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the scrip...

8.8CVSS
SaveExploits0References3
NVD
NVD
added 3 hours ago5 views

CVE-2026-69251

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...

9CVSS
SaveExploits1References1
EUVD
EUVD
added 3 hours ago3 views

EUVD-2026-52740

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...

9.8CVSS6.5AI score
SaveExploits0References2
CVE
CVE
added 3 hours ago8 views

CVE-2026-69098

Kotaemon 0.12.0 and earlier versions are vulnerable to an insecure deserialization in the check_connection endpoint. An unauthenticated attacker can supply crafted YAML/JSON input containing a type field to instantiate arbitrary Python classes. The attacker can override the type to subprocess.che...

9.8CVSS6.5AI score
SaveExploits0References2
Patchstack
Patchstack
added 3 hours ago2 views

NPM: Flowise Sandbox Escape to RCE

NPM: Flowise Sandbox Escape to RCE vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

9CVSS5.5AI score
SaveExploits0References5Affected Software1
Patchstack
Patchstack
added 3 hours ago4 views

NPM: Flowise Sandbox Escape to RCE

NPM: Flowise Sandbox Escape to RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

9CVSS5.5AI score
SaveExploits0References5Affected Software1
CVE
CVE
added 4 hours ago10 views

CVE-2026-18770

VibeSurf (vibesurf-ai) is affected up to commit cd6e519d507cdd4d63061300bf60fb176e1f57e0. The vulnerability targets the Python Validation Handler’s code in the /code path, where an unspecified function may be manipulated to achieve code injection. The advisory reports remote exploitation as possi...

7.5CVSS6.7AI score
SaveExploits0References5
Github Security Blog
Github Security Blog
added 4 hours ago6 views

Flowise RCE via TypeORM DataSource

============================================================================= Security Advisory elttam Topic: Flowise RCE via TypeORM DataSource Module: FlowiseAI/Flowise Disclosed: 15-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2 I. Background Flowise AI is an open-source, low-co...

9CVSS6.2AI score
SaveExploits1References2Affected Software2
Patchstack
Patchstack
added 4 hours ago4 views

NPM: Flowise RCE via TypeORM DataSource

NPM: Flowise RCE via TypeORM DataSource vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

9CVSS5.4AI score
SaveExploits1References2Affected Software1
Patchstack
Patchstack
added 4 hours ago5 views

NPM: Flowise RCE via TypeORM DataSource

NPM: Flowise RCE via TypeORM DataSource vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

9CVSS5.4AI score
SaveExploits1References2Affected Software1
Rows per page
Query Builder