Lucene search
+L

1112315 matches found

Github Security Blog
Github Security Blog
added 5 days ago13 views

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This...

9.5CVSS6.1AI score0.00523EPSS
SaveExploits0References5Affected Software2
RedhatCVE
RedhatCVE
added 5 days ago6 views

CVE-2026-15307

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

8.8CVSS6AI score0.00538EPSS
SaveExploits0References10
Cvelist
Cvelist
added 5 days ago35 views

CVE-2026-70470 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

9.5CVSS0.00523EPSS
SaveExploits0References4
CVE
CVE
added 5 days ago44 views

CVE-2026-70470

Flowise CVE-2026-70470: Before version 3.1.3, the validatePythonCodeForDataFrame checker in Flowise allows bypass via Unicode homoglyphs in identifiers, circumventing the ASCII word-boundary blacklist and enabling arbitrary Python execution inside Pyodide with potential full OS command execution ...

9.5CVSS5.9AI score0.00523EPSS
SaveExploits0References4
The Hacker News
The Hacker News
added 5 days ago13 views

Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens

The commercial phishing-as-a-service PhaaS toolkit known as Greatness has become the latest crimeware solution to add support for device code phishing, a rapidly growing cyber threat that abuses the legitimate OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authentication MFA and seiz...

5.5AI score
SaveExploits0
EUVD
EUVD
added 5 days ago9 views

EUVD-2026-52802

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosu...

9.8CVSS5.6AI score0.00542EPSS
SaveExploits0References3
CVE
CVE
added 5 days ago39 views

CVE-2026-24254

CVE-2026-24254 affects NVIDIA Dynamo for Linux in the multimodal serving topology. The vulnerability permits an out-of-bounds write, with potential consequences including code execution, privilege escalation, data tampering, denial of service, and information disclosure. Affected software/version...

9.8CVSS5.6AI score0.00542EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
added 5 days ago36 views

CVE-2026-24254

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosu...

9.8CVSS0.00542EPSS
SaveExploits0References3
Cvelist
Cvelist
added 5 days ago33 views

CVE-2026-69264 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...

9.4CVSS0.00578EPSS
SaveExploits0References4
EUVD
EUVD
added 5 days ago7 views

EUVD-2026-52801

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...

9.4CVSS6.3AI score0.00578EPSS
SaveExploits0References4
CVE
CVE
added 5 days ago41 views

CVE-2026-69264

Flowise CSVAgent is affected. Prior to 3.1.3, an attacker-controlled segment of csvFile’s data URI is interpolated into a Python source-template executed by Pyodide; due to the default js bridge to globalThis in Node.js, this can be passed to js.eval and dynamically import Node built-ins (e.g., f...

9.4CVSS6.3AI score0.00578EPSS
SaveExploits0References4
OSV
OSV
added 5 days ago3 views

CGA-2CM6-Q4C4-8MCH

Bulletin has no description...

6.9CVSS5.2AI score0.00276EPSS
SaveExploits0
OSV
OSV
added 5 days ago3 views

CGA-4HX9-47MF-JR9V

Bulletin has no description...

6.9CVSS5.2AI score0.00254EPSS
SaveExploits0
NVD
NVD
added 5 days ago14 views

CVE-2026-69259

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended...

9.4CVSS0.00354EPSS
SaveExploits0References4
NVD
NVD
added 5 days ago7 views

CVE-2026-69255

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...

9.2CVSS0.00313EPSS
SaveExploits0References4
NVD
NVD
added 5 days ago8 views

CVE-2026-69256

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.readpickle could deserialize a pickled...

9.4CVSS0.0039EPSS
SaveExploits0References4
NVD
NVD
added 5 days ago9 views

CVE-2026-64633

A vulnerability allowing remote unauthenticated code execution on the agent host...

10CVSS0.00337EPSS
SaveExploits1References1
NVD
NVD
added 5 days ago6 views

CVE-2026-58074

A vulnerability allowing a high-privileged user to execute arbitrary code on the server...

8.6CVSS0.00354EPSS
SaveExploits0References1
NVD
NVD
added 5 days ago7 views

CVE-2026-58072

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...

9CVSS0.00376EPSS
SaveExploits0References1
NVD
NVD
added 5 days ago9 views

CVE-2026-15307

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

8.8CVSS0.00538EPSS
SaveExploits0References7
Rows per page
Query Builder