CVE-2026-70470 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

CVE-2026-70470

Flowise CVE-2026-70470: Before version 3.1.3, the validatePythonCodeForDataFrame checker in Flowise allows bypass via Unicode homoglyphs in identifiers, circumventing the ASCII word-boundary blacklist and enabling arbitrary Python execution inside Pyodide with potential full OS command execution ...

CVE-2026-70470 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

EUVD-2026-52811

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

CVE-2026-70470 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

Security update for google-guest-agent

This update for google-guest-agent fixes the following issue: CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead to infinite loop bsc1272118. Patch Instructions: To install this SUSE update use the SUSE recommended installation metho...

SUSE-SU-2026:3496-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issue - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead to infinite loop bsc1272118...

SUSE-SU-2026:3480-1 Security update for kubevirt

This update for kubevirt fixes the following issues: - Security update correcting a CVE over-claim from the previous update, verified by auditing the fix code actually present in the vendored tree: CVE-2026-39821 bsc1266575: the previous entry claimed this fixed by the golang.org/x/net v0.55.0...

PT-2026-67807

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description Flowise contains a flaw where the validatePythonCodeForDataFrame function in packages/components/src/pythonCodeValidator.ts can be bypassed using Unicode homoglyph identifiers. This occurs because th...

PT-2026-67908

Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This...

CVE-2026-70470: Incomplete List of Disallowed Inputs

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

JLSEC-2026-1155 Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in...

Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1mbstringncopy can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In...

Updated perl-Unicode-LineBreak package fixes a security vulnerability

The updated package fixes a security vulnerability: Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. CVE-2026-8594...

MGASA-2026-0320 Updated perl-Unicode-LineBreak package fixes a security vulnerability

The updated package fixes a security vulnerability: Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. CVE-2026-8594...

SUSE CVE-2026-39824

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString a 16-bit number of bytes, it returns a truncated string rather than an error...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

openSUSE 16: mcphost / mcphost-bash-completion / mcphost-fish-completion / etc (openSUSE-SU-2026:21480-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21480-1 advisory. - CVE-2026-5160: github.com/yuin/goldmark/renderer: Cross-site Scripting due to improper URL validation bsc1272488. - CVE-2026-39821:...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

SUSE-SU-2026:3439-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of inpu...

SUSE-SU-2026:23073-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of...