Lucene search
+L

5293 matches found

OSV
OSV
added 2026/04/23 7:10 p.m.11 views

CVE-2026-41137 Flowise: Code Injection in CSVAgent leads to Authenticated RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the...

9.4CVSS6AI score
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/04/23 7:10 p.m.7 views

CVE-2026-41137 Flowise: Code Injection in CSVAgent leads to Authenticated RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the...

9.4CVSS5.8AI score0.0145EPSS
SaveExploits1References1
CNNVD
CNNVD
added 2026/04/23 12:00 a.m.15 views

Flowise 安全漏洞

Flowise is an open-source tool developed by FlowiseAI, designed for easily building LLM applications. Prior versions of Flowise, up to 3.1.0, contained a security vulnerability. This vulnerability stemmed from the lack of proper sandboxing mechanisms in the run method of the CSVAgents class,...

9.8CVSS6AI score0.01439EPSS
SaveExploits3References1
Metasploit
Metasploit
added 2026/04/22 12:00 a.m.139 views

Flowise CSV Agent Prompt Injection RCE

This vulnerability allows remote attackers to execute arbitrary code on affected installations of FlowiseAI Flowise. Authentication is not required to exploit this vulnerability. The specific flaw exists within the run method of the CSVAgents class. The issue results from the lack of proper...

9.8CVSS6AI score0.01439EPSS
SaveExploits3
Snyk
Snyk
added 2026/04/21 8:19 p.m.8 views

Incomplete List of Disallowed Inputs

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the run function of the CSVAgents class when evaluating LLM-generated Python scripts in a pyodide environment without sufficient sandboxing. An attack...

9.8CVSS6.3AI score0.01439EPSS
SaveExploits3References2
OSV
OSV
added 2026/04/21 8:19 p.m.14 views

GHSA-3HJV-C53M-58JJ Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Abstract Trend Micro's Zero Day Initiative has identified a vulnerability affecting FlowiseAI Flowise. Vulnerability Details - Version tested: 3.0.13 - Installer file: https://github.com/FlowiseAI/Flowise - Platform tested: Ubuntu 25.10 Analysis This vulnerability allows remote attackers to execu...

9.8CVSS6.2AI score0.01439EPSS
SaveExploits3References3
Github Security Blog
Github Security Blog
added 2026/04/21 8:19 p.m.65 views

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Abstract Trend Micro's Zero Day Initiative has identified a vulnerability affecting FlowiseAI Flowise. Vulnerability Details - Version tested: 3.0.13 - Installer file: https://github.com/FlowiseAI/Flowise - Platform tested: Ubuntu 25.10 Analysis This vulnerability allows remote attackers to execu...

9.8CVSS6.2AI score0.01439EPSS
SaveExploits3References3Affected Software2
Positive Technologies
Positive Technologies
added 2026/04/21 12:00 a.m.11 views

PT-2026-34236

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0 Description A flaw exists in the run method of the CSV Agents class due to improper sandboxing when evaluating Python scripts generated by a Large Language Model LLM. An unauthenticated attacker can use prompt...

9.8CVSS5.8AI score0.01439EPSS
SaveExploits3References12
NVD
NVD
added 2026/04/17 8:16 p.m.8 views

CVE-2026-31927

Anviz CX7 Firmware is vulnerable to an authenticated CSV upload which allows path traversal to overwrite arbitrary files e.g., /etc/shadow, enabling unauthorized SSH access when combined with debug‑setting changes...

4.9CVSS0.00354EPSS
SaveExploits0References3
CVE
CVE
added 2026/04/17 7:24 p.m.24 views

CVE-2026-31927

CVE-2026-31927 concerns the Anviz CX7 Firmware, where an authenticated CSV upload vulnerability enables path traversal to overwrite arbitrary files (for example, /etc/shadow). This can lead to unauthorized SSH access when combined with debug‑setting changes. The available connected sources confir...

4.9CVSS6.2AI score0.00354EPSS
SaveExploits0References3Affected Software1
Patchstack
Patchstack
added 2026/04/17 9:56 a.m.13 views

WordPress Unlimited Elements For Elementor plugin <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal vulnerability

Authenticated Contributor+ Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.6...

7.5CVSS5.8AI score0.00901EPSS
SaveExploits0References1Affected Software1
Tenable Nessus
Tenable Nessus
added 2026/04/17 12:00 a.m.9 views

macOS Autodesk Fusion 360 <= 2606.0 Multiple Vulnerabilities (adsk-sa-2026-0005)

The version of Autodesk Fusion 360 installed on the remote macOS or Mac OS X host is less than or equal to 2606.0. It is, therefore, affected by multiple vulnerabilities: - A maliciously crafted HTML payload in a component name, when displayed during the delete confirmation dialog and clicked by ...

7.1CVSS6.1AI score0.00204EPSS
SaveExploits0References4
OSV
OSV
added 2026/04/16 9:44 p.m.12 views

GHSA-9WC7-MJ3F-74XV Flowise: Code Injection in CSVAgent leads to Authenticated RCE

Summary The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide the following payload: DataFrame'foo': 'bar!';import os;os.system'whoami' that will get interpolated and executed by the server. Details The code in question that introduces t...

9.4CVSS6.1AI score0.0145EPSS
SaveExploits1References3
Github Security Blog
Github Security Blog
added 2026/04/16 9:44 p.m.17 views

Flowise: Code Injection in CSVAgent leads to Authenticated RCE

Summary The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide the following payload: DataFrame'foo': 'bar!';import os;os.system'whoami' that will get interpolated and executed by the server. Details The code in question that introduces t...

9.4CVSS6.1AI score0.0145EPSS
SaveExploits1References3Affected Software2
Snyk
Snyk
added 2026/04/16 9:43 p.m.7 views

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection through the pythonCodeValidator and the Python execution paths in AirtableAgent.ts and CSVAgent.ts. An attacker can supply LLM-generated Python code that smuggles in...

8.8CVSS6.1AI score0.00603EPSS
SaveExploits1References2
Positive Technologies
Positive Technologies
added 2026/04/16 12:00 a.m.28 views

PT-2026-34729

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0 Description The CSVAgent allows the provision of custom Pandas CSV read code. Due to a lack of sanitization, an attacker can provide a command injection payload that is interpolated and executed by the server...

9.4CVSS5.9AI score0.0145EPSS
SaveExploits1References6
EUVD
EUVD
added 2026/04/14 6:30 p.m.11 views

EUVD-2026-22313

An URL Redirection to Untrusted Site 'Open Redirect' vulnerability CWE-601 vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, FortiNAC-F 7.4 all versions, FortiNAC-F 7.2 all versions may allow a remote privileged attacker with system administrator role to redirect users to an arbitrary...

2.4CVSS5.9AI score0.00209EPSS
SaveExploits0References2
NVD
NVD
added 2026/04/14 4:16 p.m.12 views

CVE-2026-21741

An URL Redirection to Untrusted Site 'Open Redirect' vulnerability CWE-601 vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, FortiNAC-F 7.4 all versions, FortiNAC-F 7.2 all versions may allow a remote privileged attacker with system administrator role to redirect users to an arbitrary...

4.8CVSS0.00209EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/04/14 3:39 p.m.6 views

CVE-2026-21741

An URL Redirection to Untrusted Site 'Open Redirect' vulnerability CWE-601 vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, FortiNAC-F 7.4 all versions, FortiNAC-F 7.2 all versions may allow a remote privileged attacker with system administrator role to redirect users to an arbitrary...

2.4CVSS5.9AI score0.00209EPSS
SaveExploits0References1
CVE
CVE
added 2026/04/14 3:39 p.m.26 views

CVE-2026-21741

Fortinet FortiNAC-F is affected by an Open Redirect (CWE-601) vulnerability across FortiNAC-F 7.6.0–7.6.5, FortiNAC-F 7.4 all versions, and FortiNAC-F 7.2 all versions. The issue allows a remote privileged attacker with the system administrator role to redirect users to an arbitrary website by up...

4.8CVSS5.9AI score0.00209EPSS
SaveExploits0References1Affected Software1
Rows per page
Query Builder