CVE-2026-69257

Flowise prior to v3.1.3 had an SSRF protection bypass in its HTTP security module due to improper handling of IPv4-mapped IPv6 addresses (::ffff:127.0.0.1, ::ffff:169.254.169.254). ipaddr.js categorizes these as IPv6, so IPv4 CIDR deny-list checks were skipped in isDeniedIP(), allowing requests f...

CVE-2026-15307 Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CVE-2026-15307 Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

curl: CVE-2026-18924: HTTP/2 server push UAF

A vulnerability was discovered in libcurl versions 8.21.0 and later, where a use-after-free issue could occur in the HTTP/2 server push functionality. The vulnerability was caused by the fact that when a pushed transfer ends, the connection's pool is not properly handled, leading to the freed...

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain 1. Python code injection via base64string = "$base64String" CSVAgent.ts line 161 2. Pyodide js bridge provides access to...

GHSA-3769-JGQC-CXM7 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

Summary A sandbox escape vulnerability in executeJavaScriptCode allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function accepts caller-provided nodeVMOptions that override the default sandbox security settings via JavaScript's spread operator...

CVE-2026-69254 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...

CVE-2026-67199

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...

CLSA-2026-1785204346 TuxCare security update for webpack-dev-server (3 CVEs)

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.7.1-tuxcare.4...

CLSA-2026-1784943228 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 2.11.5-tuxcare.3...

CLSA-2026-1784943286 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 2.7.1-tuxcare.3...

CLSA-2026-1784856456 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 3.1.14-tuxcare.3...

CLSA-2026-1784769600 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 3.11.2-tuxcare.2...

CLSA-2026-1784856196 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 3.11.0-tuxcare.4...

CLSA-2026-1784683093 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 2.7.1-tuxcare.1...

CLSA-2026-1784683094 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.11.0-tuxcare.2...

CLSA-2026-1784769523 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 3.11.3-tuxcare.3...

CLSA-2026-1779238046 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.15.1-tuxcare.3...

xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow

A flaw was found in the glamorfontget function of the xorg-x11-server. This vulnerability, a heap buffer overflow, occurs when the server processes a specially crafted PCF font file where individual glyph metrics exceed the declared maximum bounds. An authenticated X client can exploit this by...

X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent()

A flaw was found in the X.org X11 server, specifically within the GLX OpenGL Extension to the X Window System dispatch layer. A remote attacker can exploit this vulnerability by sending a series of crafted X11 requests. This can lead to a use-after-free condition, where the server attempts to wri...