262361 matches found
CVE-2026-70471 Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetche...
CVE-2026-24253
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service and data tampering...
CVE-2026-69263
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LDLIBRARYPATH, DYLDLIBRARYPATH, and NODEOPTIONS by exact...
CVE-2026-64634
A vulnerability allowing local privilege escalation to the Reporter service context...
CVE-2026-10032
creationtimestamp| type| source ---|---|--- 2026-08-04 16:48:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/j7o7c57m4b5cj...
CVE-2026-21366
creationtimestamp| type| source ---|---|--- 2026-08-04 16:45:15+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-qualcomm-10...
CVE-2026-25289
creationtimestamp| type| source ---|---|--- 2026-08-04 16:45:02+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-qualcomm-10 2026-08-04 18:16:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbmmzbd3g2m 2026-08-04 23:37:36+00:00| seen|...
CVE-2026-15830
creationtimestamp| type| source ---|---|--- 2026-08-04 16:29:42+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/h5c2dvuor5uzy 2026-09-16 20:00:13+00:00| seen| https://bsky.app/profile/djangonews.bsky.social/post/3mvnwirlrtq2s...
CVE-2026-64634
A vulnerability allowing local privilege escalation to the Reporter service context...
GHSA-C6XH-WV4J-PPV5 Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses
Summary Flowise's HTTP security module httpSecurity.ts fails to normalize IPv4-mapped IPv6 addresses e.g., ::ffff:127.0.0.1, ::ffff:169.254.169.254 before checking them against the deny list. Due to an ipaddr.js kind mismatch ipv6 vs ipv4, all IPv4 CIDR deny rules are silently skipped for...
CVE-2026-15830
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...
EUVD-2026-52742
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...
CVE-2026-24078
Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling...
EUVD-2026-52728
Memory corruption while processing a packet with a size close to the maximum allowed value...
CLSA-2026-1785291689 TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 1.6.2-tuxcare.4...
CLSA-2026-1785291891 TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 1.7.5-tuxcare.5...
CLSA-2026-1785291685 TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 0.26.1-tuxcare.4...
CLSA-2026-1785117393 TuxCare security update for form-data (1 CVE)
TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.2.0-tuxcare.2...