Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection in the CSVAgent process, where user-supplied input is used to construct Python code executed via pyodide. An attacker can execute arbitrary code by supplying a crafte...

Arbitrary Code Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection in the CSVAgent process, where user-supplied input is used to construct Python code executed via pyodide. An attacker can execute arbitrary code by supplying a crafted payload that...

EUVD-2026-52740

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...

CVE-2026-69098

Kotaemon 0.12.0 and earlier versions are vulnerable to an insecure deserialization in the check_connection endpoint. An unauthenticated attacker can supply crafted YAML/JSON input containing a type field to instantiate arbitrary Python classes. The attacker can override the type to subprocess.che...

CVE-2026-69098 kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...

CVE-2026-69098 kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...

CVE-2026-69098

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...

CVE-2026-69098 kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...

Exploit for Deserialization of Untrusted Data in Microsoft

cve-2025-53770-research 🚨 Threat intel & incident response...

Security Bulletin: Vulnerabilities in jackson-databind may affect IBM APM Linux KVM Agent for Virtual Environments.

Summary There are vulnerabilities in the jackson-databind jar used by IBM APM Linux KVM Agent for Virtual Environments. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From...

[SECURITY] [DLA 4716-1] ruby2.7 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4716-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA August 04, 2026 https://wiki.debian.org/LTS -...

Exploit for CVE-2026-21020

--- CVE-2026-21020 – Protobuf Message Parsing Polymorphic De...

PT-2026-67767

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An authenticated user with permissions to create or modify a chatflow can achieve remote code execution via the CSVAgent node. The node allows users to provide Python code executed through pyodide,...

CVE-2026-69098: Deserialization of Untrusted Data

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...

CVE-2026-47623: Deserialization of Untrusted Data

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to denial of service and data tampering...

Important: dotnet10.0

Issue Overview: Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47300 Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

PT-2026-68506

Name of the Vulnerable Software and Affected Versions Ajax Search Lite versions prior to 4.14.5 Description The Ajax Search Lite – Live Search & Filter plugin for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object...

PT-2026-67805

Name of the Vulnerable Software and Affected Versions NVIDIA Dynamo for Linux affected versions not specified Description An issue exists where an attacker could cause deserialization of untrusted data. Deserialization is the process of converting a data format, such as JSON or XML, back into an...

Security Bulletin: NVIDIA Dynamo - August 2026

NVIDIA has released a software update for NVIDIA® Dynamo. To protect your system, clone or update this software from the NVIDIA ai-dynamo/dynamo GitHub repo. Go to NVIDIA Product Security. Details The following table summarizes the potential vulnerabilities that this security update addresses and...

Important: dotnet8.0

Issue Overview: Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47300 Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...