45828 matches found
MAL-2026-11540 Malicious code in hubert-application-get-document-preview-am (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e887ef3c3509ebfe43d231ff354e4e0d7f8eb20c9da05389324446d44fc589 On require of the package, index.js loads setup.js which selects a platform key, downloads a native binary from one of four hardcoded workers.dev...
MAL-2026-11535 Malicious code in bigops-backend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41 On require, adapter.js selects a platform-specific asset path, iterates a list of obfuscated Cloudflare Workers hostnames assembled at runtime by...
CVE-2026-70619 Odysseus Missing Admin Authorization via Embedding Endpoint Routes
Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers...
Improper Restriction of Rendered UI Layers or Frames
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the FilePreview process. An attacker can gain unauthorized access to session tokens and potentially take over user accounts by serving a crafted HTML fi...
CVE-2026-48154 GoRest: InMemorySecret2FA race condition allows process crash via concurrent map access
GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and...
Arbitrary Code Injection
Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via the run method in the CSVAgents class. An attacker can execute arbitrary code in the context of the server process by sending crafted prompts to a chatflow using the CSV Agent...
Arbitrary Code Injection
Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via the run method in the CSVAgents class. An attacker can execute arbitrary code in the context of the server process by sending crafted prompts to a chatflow using...
External Control of File Name or Path
Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to External Control of File Name or Path via the S3 Directory loader process. An attacker can write arbitrary files to locations outside the intended temporary directory by supplying crafted S3...
GHSA-VMV7-4M6C-3CG5 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain 1. Python code injection via base64string = "$base64String" CSVAgent.ts line 161 2. Pyodide js bridge provides access to...
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain 1. Python code injection via base64string = "$base64String" CSVAgent.ts line 161 2. Pyodide js bridge provides access to...
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
Summary A sandbox escape vulnerability in executeJavaScriptCode allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function accepts caller-provided nodeVMOptions that override the default sandbox security settings via JavaScript's spread operator...
CVE-2026-69254
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...
CVE-2026-67198
Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with ...
CVE-2026-24079 Missing Authentication for Critical Function in Data Modem
Cryptographic Issue while processing registration requests with malformed or missing authentication parameters...
CLSA-2026-1771894663 TuxCare security update for symfony/process (2 CVEs)
TuxCare rebuilt symfony/process to address 2 CVEs. Fixed in 4.4.44-p1+tuxcare...
CLSA-2026-1771808253 TuxCare security update for symfony/process (1 CVE)
TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 6.4.13-p2+tuxcare...
CLSA-2026-1771894652 TuxCare security update for symfony/process (1 CVE)
TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 5.4.45-p2+tuxcare...
CLSA-2025-1761785574 TuxCare security update for symfony/process (1 CVE)
TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 6.4.13-p1+tuxcare...