Lucene search
+L

970285 matches found

EUVD
EUVD
added 6 hours ago4 views

EUVD-2026-52764

A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function saveurlimage of the file agent/imagegenprovider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has...

6.5CVSS5.1AI score
SaveExploits0References5
EUVD
EUVD
added 6 hours ago4 views

EUVD-2026-52761

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...

9CVSS5.7AI score
SaveExploits0References1
Cvelist
Cvelist
added 6 hours ago7 views

CVE-2026-58072

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...

9CVSS
SaveExploits0References1
CVE
CVE
added 6 hours ago6 views

CVE-2026-64633

The CVE-2026-6463? document describes a vulnerability allowing remote unauthenticated code execution on the agent host. Based on the provided metrics, this is a CRITICAL (CVSSv4.0: 10.0) issue with a NETWORK attack vector, no privileges required and no user interaction needed. Impact is rated HIG...

10CVSS6.1AI score
SaveExploits0References1
CVE
CVE
added 6 hours ago10 views

CVE-2026-58072

CVE-2026-58072 : The vulnerability affects the Veeam Service Provider Console. It enables arbitrary file write on the management server, which can lead to remote code execution. The CVSS v4.0 score is 9.0 (CRITICAL) with network attack vector, no user interaction, and high impacts on confidential...

9CVSS5.7AI score
SaveExploits0References1
EUVD
EUVD
added 6 hours ago4 views

EUVD-2026-52755

A vulnerability allowing remote unauthenticated code execution on the agent host...

10CVSS6.1AI score
SaveExploits0References1
Cvelist
Cvelist
added 6 hours ago7 views

CVE-2026-64633

A vulnerability allowing remote unauthenticated code execution on the agent host...

10CVSS
SaveExploits0References1
EUVD
EUVD
added 6 hours ago4 views

EUVD-2026-52747

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

8.8CVSS5.8AI score
SaveExploits0References7
CVE
CVE
added 6 hours ago9 views

CVE-2026-15307

CVE-2026-15307 affects Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups cast the right-hand side of a filter to a GDALRaster, and any value (including untrusted input) is opened for writing or treated as a datasource, enabling a file to be written with an attacker-chosen n...

8.8CVSS5.8AI score
SaveExploits0References7
Cvelist
Cvelist
added 6 hours ago7 views

CVE-2026-15307 Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

8.8CVSS
SaveExploits0References7
Patchstack
Patchstack
added 6 hours ago3 views

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise versions = 3.1.2...

9.4CVSS5.6AI score
SaveExploits0References5Affected Software1
Patchstack
Patchstack
added 6 hours ago3 views

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

9.4CVSS5.6AI score
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 6 hours ago4 views

Flowise: Remote Code Execution Vulnerability in CSVAgent

Summary The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to utilise the pandas library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, panda...

9.4CVSS6.1AI score
SaveExploits0References5Affected Software2
Github Security Blog
Github Security Blog
added 6 hours ago3 views

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain 1. Python code injection via base64string = "$base64String" CSVAgent.ts line 161 2. Pyodide js bridge provides access to...

9.2CVSS5.7AI score
SaveExploits0References5Affected Software2
OSV
OSV
added 6 hours ago2 views

GHSA-VMV7-4M6C-3CG5 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain 1. Python code injection via base64string = "$base64String" CSVAgent.ts line 161 2. Pyodide js bridge provides access to...

9.2CVSS5.7AI score
SaveExploits0References5
Patchstack
Patchstack
added 6 hours ago3 views

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

9.2CVSS5.7AI score
SaveExploits0References5Affected Software1
Patchstack
Patchstack
added 6 hours ago3 views

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

9.2CVSS5.7AI score
SaveExploits0References5Affected Software1
Cvelist
Cvelist
added 6 hours ago6 views

CVE-2026-69255 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...

9.2CVSS
SaveExploits0References4
CVE
CVE
added 6 hours ago10 views

CVE-2026-69255

Flowise CVE-2026-69255 affects the CSVAgent component (packages/components/nodes/agents/CSVAgent/CSVAgent.ts) prior to version 3.1.3. The vulnerability stems from attacker-controlled CSV data being interpolated into a Python block via base64String = "${base64String}" after naively parsing CSV wit...

9.2CVSS6AI score
SaveExploits0References4
Patchstack
Patchstack
added 7 hours ago4 views

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

9.4CVSS5.4AI score
SaveExploits0References5Affected Software1
Rows per page
Query Builder