PT-2026-73864

TuxCare rebuilt node-uuid to address 1 CVE. Fixed in 1.4.3-tuxcare.1...

PT-2026-89553

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=541969271 Crash type: Check failed Crash state: CheckUnwind mrb basic alloc func pm node hash insert...

CVE-2026-70477: Improper Control of Generation of Code

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed...

PT-2026-67830

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An unauthenticated remote attacker can execute arbitrary code in the context of the service account or the user running the server. The issue occurs when a chatflow uses a CSV Agent node, where the r...

PT-2026-74253

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.7.3-tuxcare.1...

PT-2026-74252

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 2.6.1-tuxcare.1...

PT-2026-74250

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.6.3-tuxcare.1...

PT-2026-67910

-- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: Flowise - Flowise -- VULNERABILITY DETAILS ------------------------ Version tested: 3.1.1 Installer file: https://github.com/FlowiseAI/Flowise npm...

PT-2026-67810

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description Flowise injects $vars into the code execution sandbox without requiring the variables:view permission, which bypasses the permission-protected Variables API. An unauthorized user or API key denied...

The vulnerability of the library for web requests, node-XMLHttpRequest, related to errors in the certificate validation process, allows a perpetrator to trigger a service failure.

The vulnerability of the node-XMLHttpRequest library for web requests is related to errors in the certificate validation process. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2026-74304

TuxCare rebuilt node-forge to address 4 CVEs. Fixed in 0.10.0-tuxcare.6...

PT-2026-74234

TuxCare rebuilt node-forge to address 6 CVEs. Fixed in 0.10.0-tuxcare.4...

PT-2026-74229

TuxCare rebuilt node-forge to address 2 CVEs. Fixed in 0.10.0-tuxcare.1...

MiracleLinux 8 : nodejs:22 (AXSA:2026-1453:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1453:01 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

SUSE CVE-2026-18446

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...