EUVD-2026-52811

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

CVE-2026-70470 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

CVE-2026-70470

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

CVE-2026-69264 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...

Exploit for CVE-2026-17543

PHP CVE-2026-17543 Exposure Validator Safe network-side valid...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

Improper Certificate Validation

Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Certificate Validation in the isEmailConstrained and isURIConstrained methods of PKIXNameConstraintValidator, which compare rfc822Name and URI...

Improper Certificate Validation

Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Certificate Validation in the isEmailConstrained and isURIConstrained methods of PKIXNameConstraintValidator, which compare rfc822Name and...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the isEmailConstrained and isURIConstrained methods of PKIXNameConstraintValidator, which compare rfc822Name and URI subjectAltName values with a bare equalsIgnoreCase and do not strip a trailing dot t...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the isEmailConstrained and isURIConstrained methods of PKIXNameConstraintValidator, which compare rfc822Name and URI subjectAltName values with a bare equalsIgnoreCase and do not strip a trailing dot t...

CVE-2026-59641

In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcmail-fips and bcjmail-fips 1.0.7 1.0.X series, 2.0.7 2.0.X series and...

DEBIAN-CVE-2026-59641

In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcmail-fips and bcjmail-fips 1.0.7 1.0.X series, 2.0.7 2.0.X series and...

CVE-2026-59641

In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcmail-fips and bcjmail-fips 1.0.7 1.0.X series, 2.0.7 2.0.X series and...

CVE-2026-59641

CVE-2026-59641 affects Bouncy Castle for Java: before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation; also affects Java LTS before 2.73.12 and Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.x), 2.0.7 (2.0.x), and 2.1.7 (2.1.x). CVSS v4.0 base scor...