12736 matches found
CVE-2026-45537 OpenSIPS: Global Buffer Overflow in construct_uri
OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the constructuri function concatenates multiple URI components protocol, username, domain, port, params into a fixed 1024-byte global BSS buffer without any bounds checking. When a routi...
GHSA-W72Q-X6W3-7RJ3 Duplicate Advisory: @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72qq-p3r5-f7wq. This link is maintained to preserve external references. Original Description The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the U...
Duplicate Advisory: @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72qq-p3r5-f7wq. This link is maintained to preserve external references. Original Description The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the U...
CVE-2026-69264
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
Summary Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis which on Node.js exposes eval and dynamic import, the...
NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
GHSA-4J8X-X6V7-W9RQ Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
Summary Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis which on Node.js exposes eval and dynamic import, the...
CVE-2026-69264 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...
CVE-2026-69264 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...
CVE-2026-69264
Flowise CSVAgent is affected. Prior to 3.1.3, an attacker-controlled segment of csvFile’s data URI is interpolated into a Python source-template executed by Pyodide; due to the default js bridge to globalThis in Node.js, this can be passed to js.eval and dynamically import Node built-ins (e.g., f...
CVE-2026-69264 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...
CVE-2026-10032 Arbitrary JavaScript Execution via openUrl in @a2ui/web_core
The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...
CVE-2026-10032
The CVE-2026-10032 issue involves the openUrl function in @a2ui/web_core, which passes an agent-controlled URL directly to window.open() without URI scheme validation. A malicious actor can supply a javascript: URI as the url argument for a Button component’s functionCall action, allowing arbitra...
CLSA-2026-1784769612 TuxCare security update for fast-uri (6 CVEs)
TuxCare rebuilt fast-uri to address 6 CVEs. Fixed in 2.4.2-tuxcare.1...
CLSA-2026-1784769538 TuxCare security update for fast-uri (1 CVE)
TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 3.0.1-tuxcare.2...
CLSA-2026-1784596352 TuxCare security update for fast-uri (5 CVEs)
TuxCare rebuilt fast-uri to address 5 CVEs. Fixed in 2.4.0-tuxcare.1...
CLSA-2026-1784682957 TuxCare security update for fast-uri (2 CVEs)
TuxCare rebuilt fast-uri to address 2 CVEs. Fixed in 3.0.3-tuxcare.2...