PT-2026-68307

Name of the Vulnerable Software and Affected Versions praisonai versions 3.9.26 through 4.6.57 praisonaiagents versions 0.12.12 through 1.6.57 Description The workflow include feature allows for arbitrary Python code execution. The Workflow. execute include function implicitly imports and runs a...

CVE-2026-55522: Improper Control of Generation of Code

PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow.executeinclude implicitly imports and runs an included recipe's tools.py via a raw...

Linux Distros Unpatched Vulnerability : CVE-2026-67855

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UAENABLEGDSPUSHMANAGEMENT is enabled. This allows a remote...

CVE-2026-6639: Missing Authorization

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

UBUNTU-CVE-2026-67855

open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UAENABLEGDSPUSHMANAGEMENT is enabled. This allows a remote attacker to cause a denial of service...

Authorization Bypass Through User-Controlled Key

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the GraphQL node's Authentication parameter, which accepts expression values and, when several credentials of different types are attached in...

EUVD-2026-52871

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission middleware that protects other execution endpoints. Any authenticated use...

Langflow agent Function Bypass

The vulnerability of the getflowbyidorendpointname function in the Langflow agent and workflow creation/execution tools relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions using an...

CVE-2026-70475: Missing Authorization

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission middleware that protects other execution endpoints. Any authenticated use...

PT-2026-68034

Name of the Vulnerable Software and Affected Versions AI Chatbot & Workflow Automation by AIWU versions prior to 1.4.7 Description An issue exists where the getCurrentTaskResults function in modules/workspace/controller.php is accessible without authentication or authorization. This occurs becaus...

spotlight

Spotlight by CMUL8 The AI security engineer. Phase 1 MVP — ve...

exploitarium

Statement This repo was incomplete when published. In regar...

Exploit for CVE-2026-58424

CVE-2026-58424 - Gitea Fork PR Workflow Approval Gate Bypass...

@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification

Summary A template injection vulnerability in the createworkflowfornotification tool lets a caller embed Jinja2 expressions that the Dynatrace workflow engine evaluates at runtime, exfiltrating event data to attacker-controlled destinations through a workflow that persists in the tenant after the...

GHSA-XRMJ-5G4G-8987 @dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification

Summary A template injection vulnerability in the createworkflowfornotification tool lets a caller embed Jinja2 expressions that the Dynatrace workflow engine evaluates at runtime, exfiltrating event data to attacker-controlled destinations through a workflow that persists in the tenant after the...

CVE-2026-68577

Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked...

CVE-2026-68576

Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked...

CVE-2026-68575

Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked...

CVE-2026-68574

Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked...

CVE-2026-56673

ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folderpaths.getannotatedfilepath and existsannotatedfilepath join workflow-controlled annotated filenames to a base directory without a containment check, allowing an unauthenticated craft...