CVE-2026-73485

Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the...

CVE-2026-73486

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...

CLEANSTART-2026-GR38496 Security fixes in aws-eks-pod-identity-agent 0.2.1-r1

Package aws-eks-pod-identity-agent version 0.2.1-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-DJ79575 Security fixes in amazon-cloudwatch-agent-fips 1.300069.0-r1

Package amazon-cloudwatch-agent-fips version 1.300069.0-r1 fixes 10 vulnerabilities: CVE-2026-34040, CVE-2026-33997, CVE-2026-42151, CVE-2026-44903, ghsa-fw8g-cg8f-9j28...

CLEANSTART-2026-OD94045 Security fixes in aws-network-policy-agent-fips 1.3.7-r1

Package aws-network-policy-agent-fips version 1.3.7-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-HG20195 Security fixes in ip-masq-agent 2.12.0-r1

Package ip-masq-agent version 2.12.0-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-33814...

CLEANSTART-2026-OB14501 Security fixes in aws-network-policy-agent 1.3.5-r2

Package aws-network-policy-agent version 1.3.5-r2 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-XR03765 Security fixes in proxy-agent 7.0.0-r2

Package proxy-agent version 7.0.0-r2 fixes 5 vulnerabilities: CVE-2026-69192, CVE-2026-54272, CVE-2026-69198, CVE-2026-41324, CVE-2026-44240...

EUVD-2026-57802

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...

CVE-2026-73487 Flowise before 3.1.3 Prompt Injection RCE via CSV Agent

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.readjson to exfiltrate datasets, perform SSRF...

CVE-2026-73487 Flowise before 3.1.3 Prompt Injection RCE via CSV Agent

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.readjson to exfiltrate datasets, perform SSRF...

CVE-2026-73486

CVE-2026-73486 (Flowise) : Flowise versions before 3.1.3 contain a code injection vulnerability in the CSV Agent node’s customReadCSV parameter. An authenticated attacker can trigger arbitrary Python code execution by bypassing a static regex blocklist used for validation, enabling code execution...

CVE-2026-73486 Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...

CVE-2026-73487

Flowise prior to version 3.1.3 is affected by a vulnerability in the CSV and Airtable Agent nodes where a regex-based Python code validator bypass enables unauthenticated prompt injection. This can allow an attacker to inject and execute code, exfiltrate datasets via unblocked pandas functions (e...

CVE-2026-73486 Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...

EUVD-2026-57801

Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the...

CVE-2026-73485 Flowise before 3.1.3 Remote Code Execution via Airtable Agent

Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the...

CVE-2026-73485 Flowise before 3.1.3 Remote Code Execution via Airtable Agent

Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the...

CVE-2026-73485

Flowise before version 3.1.3 contains a code injection vulnerability in the Airtable Agent node that lets unauthenticated attackers bypass the pythonCodeValidator blocklist via obfuscation and inject malicious Python code. The injected code can run in an unsandboxed pyodide environment with full ...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-128)

Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys Description: Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that...