Node-RED Unauthenticated Flow RCE

Deploys a malicious Node-RED flow via the admin API when authentication is disabled or credentials are known. Uses an inject + exec node chain to run the configured reverse CMD payload. Complements CVE-2026-71269 detection. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RED unauthenticated flo...

CVE-2026-67443

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is tru...

Langflow Code Execution

The vulnerability of the endpoint of the application programming interface/api/v1/buildpublictmp/flowid/flow for creating and deploying Langflow agents and processes is related to the lack of authentication for the critical function. Exploiting this vulnerability allows a malicious actor to execu...