Lucene search
+L

1112433 matches found

CVE
CVE
added 6 days ago83 views

CVE-2026-15307

CVE-2026-15307 affects Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups cast the right-hand side of a filter to a GDALRaster, and any value (including untrusted input) is opened for writing or treated as a datasource, enabling a file to be written with an attacker-chosen n...

8.8CVSS5.8AI score0.00538EPSS
SaveExploits0References7
Vulnrichment
Vulnrichment
added 6 days ago7 views

CVE-2026-15307 Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

8.8CVSS5.8AI score0.00538EPSS
SaveExploits0References7
Cvelist
Cvelist
added 6 days ago42 views

CVE-2026-15307 Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

8.8CVSS0.00538EPSS
SaveExploits0References7
OSV
OSV
added 6 days ago5 views

MAL-2026-11569 Malicious code in @nebula.js/locale (npm)

npm/@nebula.js/locale is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

5.9AI score
SaveExploits0References6
Patchstack
Patchstack
added 6 days ago7 views

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

9.4CVSS5.6AI score0.0039EPSS
SaveExploits0References5Affected Software1
Patchstack
Patchstack
added 6 days ago6 views

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise versions = 3.1.2...

9.4CVSS5.6AI score0.0039EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 6 days ago9 views

Flowise: Remote Code Execution Vulnerability in CSVAgent

Summary The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to utilise the pandas library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, panda...

9.4CVSS6.1AI score0.0039EPSS
SaveExploits0References5Affected Software2
OSV
OSV
added 6 days ago5 views

GHSA-X6VM-W76M-8J7G Flowise: Remote Code Execution Vulnerability in CSVAgent

Summary The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to utilise the pandas library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, panda...

9.4CVSS6.1AI score0.0039EPSS
SaveExploits0References5
Cvelist
Cvelist
added 6 days ago34 views

CVE-2026-69256 Flowise: Remote Code Execution Vulnerability in CSVAgent

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.readpickle could deserialize a pickled...

9.4CVSS0.0039EPSS
SaveExploits0References4
CVE
CVE
added 6 days ago41 views

CVE-2026-69256

Flowise CVE-2026-69256 affects the CSVAgent node prior to version 3.1.3. A user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc} and can execute via Pyodide, bypassing a denylist with a pandas.read_pickle payload. An authenticated user who can create/modify a chatflow can add th...

9.4CVSS6.2AI score0.0039EPSS
SaveExploits0References4
EUVD
EUVD
added 6 days ago6 views

EUVD-2026-52746

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.readpickle could deserialize a pickled...

9.4CVSS6.2AI score0.0039EPSS
SaveExploits0References4
OSV
OSV
added 6 days ago4 views

MAL-2026-11823 Malicious code in @servicetitan/anvil2-codemods (npm)

npm/@servicetitan/anvil2-codemods is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

5.9AI score
SaveExploits0References12
OSSF Malicious Packages
OSSF Malicious Packages
added 6 days ago6 views

Malicious code in @servicetitan/unit-tests (npm)

npm/@servicetitan/unit-tests is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

5.8AI score
SaveExploits0References12
OSV
OSV
added 6 days ago4 views

MAL-2026-11935 Malicious code in @servicetitan/titan-chat-ui (npm)

npm/@servicetitan/titan-chat-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

6.4AI score
SaveExploits0References12
Github Security Blog
Github Security Blog
added 6 days ago10 views

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain 1. Python code injection via base64string = "$base64String" CSVAgent.ts line 161 2. Pyodide js bridge provides access to...

9.2CVSS5.7AI score0.00313EPSS
SaveExploits0References5Affected Software2
Patchstack
Patchstack
added 6 days ago5 views

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

9.2CVSS5.7AI score0.00313EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 6 days ago8 views

GHSA-VMV7-4M6C-3CG5 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain 1. Python code injection via base64string = "$base64String" CSVAgent.ts line 161 2. Pyodide js bridge provides access to...

9.2CVSS5.7AI score0.00313EPSS
SaveExploits0References5
Patchstack
Patchstack
added 6 days ago5 views

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

9.2CVSS5.7AI score0.00313EPSS
SaveExploits0References5Affected Software1
EUVD
EUVD
added 6 days ago6 views

EUVD-2026-52745

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...

9.2CVSS6AI score0.00313EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 6 days ago7 views

CVE-2026-69255

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...

9.2CVSS6AI score0.00313EPSS
SaveExploits0References5Affected Software1
Rows per page
Query Builder