52975 matches found
Malicious code in datefmt-pro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector addca973f3384757b9ff2e00e5becd70e509ef5233c4cd2dc6ce73019b467787 datefmt-pro presents itself as a date formatting utility, but its actual behavior is an install-time reconnaissance beacon. The scripts.postinstall...
CVE-2026-70374 HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extnamefilename and passes it, unescaped, into a...
CVE-2026-16793
An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator LXCO 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance...
EUVD-2026-52886
An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator LXCO 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance...
CVE-2026-70470
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...
CVE-2026-69100
LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the scrip...
GHSA-VMV7-4M6C-3CG5 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection â Root Shell Verified
UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical â a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain 1. Python code injection via base64string = "$base64String" CSVAgent.ts line 161 2. Pyodide js bridge provides access to...
CVE-2026-69254
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...
CVE-2026-69254
CVE-2026-69254 affects Flowise versions before 3.1.3. The issue arises in the executeJavaScriptCode() path where caller-provided nodeVMOptions are merged with default NodeVM security settings, allowing an attacker to override the sandbox protection. By reaching packages/server/src/routes/node-cus...
EUVD-2026-52742
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...
CVE-2026-69254 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...
CVE-2026-69100
The CVE entry covers LAMP Rapid Development Platform up to version 5.6.2, where a flaw in GlueFactory allows unsandboxed Groovy scripts stored in database template fields to run without compilation restrictions or whitelisting. An attacker can modify or influence the script field via message temp...
CVE-2026-67243
freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...
CVE-2026-67243
freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...
CVE-2026-67243
The CVE concerns freo2 (provided by refirio). It describes an unrestricted upload of a dangerous file type, where a user with the productâs highestâlevel admin privileges may upload an executable and execute arbitrary OS commands. CVSS details indicate a network attack vector, high impact on conf...
EUVD-2026-52636
freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...
CVE-2026-6837
CVE-2026-6837 affects Zyxel WAX650S devices, via a post-authentication command injection in the export-cgi CGI program. The flaw is exploitable by an authenticated administrator, enabling OS command execution on the device. Affected firmware versions go through 7.10(ABRM.4)C0. The CVSS 3.1 vector...
Improper Neutralization of Input Used for LLM Prompting
Overview strands-agents-tools is an A collection of specialized tools for Strands Agents Affected versions of this package are vulnerable to Improper Neutralization of Input Used for LLM Prompting via the shell tool. An attacker can execute arbitrary operating system commands by crafting a prompt...