CVE-2026-69255

Flowise CVE-2026-69255 affects the CSVAgent component (packages/components/nodes/agents/CSVAgent/CSVAgent.ts) prior to version 3.1.3. The vulnerability stems from attacker-controlled CSV data being interpolated into a Python block via base64String = "${base64String}" after naively parsing CSV wit...

Critical: Red Hat Security Advisory: OpenShift Container Platform 4.21.27 bug fix and security update

Red Hat OpenShift Container Platform release 4.21.27 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.10.1 release

Red Hat build of OpenTelemetry 3.10.1 has been released This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes. Breaking changes: None Deprecations: None Technology Preview features: None Enhancements: None Bug fixes: None Known issues: None...

CVE-2026-69098 kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...

CVE-2026-69253

Summary of findings (CVE-2026-69253). Flowise allowed in-process vm2 sandbox JavaScript execution for several tools (AgentAsTool, ChatflowTool, ExecuteFlow) with the baseURL injected into generated code, enabling code injection and sandbox escape. The vulnerability arises because baseURL validati...

EUVD-2026-52739

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code, they inserted a user-controlled...

CVE-2026-69253 Flowise Sandbox Escape to RCE

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code, they inserted a user-controlled...

n8n Webhooks - Remote Code Execution

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker,...

EUVD-2026-52726

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...

CVE-2026-69252

Flowise CVE-2026-69252: Before 3.1.3, the /api/v1/files route was protected only by feat:files and did not enforce checkPermission on GET/DELETE. A low-privileged, authenticated API key could list files under the organization root and delete files in other workspaces within the same organization ...

CVE-2026-69252 Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...

CLSA-2026-1781052728 TuxCare security update for starlette (1 CVE)

TuxCare rebuilt starlette to address 1 CVE. Fixed in 0.27.0.post3+tuxcare...

CLSA-2026-1780361392 TuxCare security update for 90 packages (1 CVE)

TuxCare rebuilt 90 packages to address 1 CVE. Fixed in 9.4.48.v20220622-tuxcare.3...

CLSA-2026-1778546718 TuxCare security update for 90 packages (13 CVEs)

TuxCare rebuilt 90 packages to address 13 CVEs. Fixed in 9.4.50.v20221201-tuxcare.1...

CLSA-2026-1776386158 TuxCare security update for io.netty (11 CVEs)

TuxCare rebuilt 47 io.netty packages to address 11 CVEs. Fixed in 4.1.93.Final-tuxcare.1...

CLSA-2026-1776213248 TuxCare security update for io.netty (6 CVEs)

TuxCare rebuilt 46 io.netty packages to address 6 CVEs. Fixed in 4.1.82.Final-tuxcare.1...

CLSA-2026-1776126830 TuxCare security update for io.netty (16 CVEs)

TuxCare rebuilt 40 io.netty packages to address 16 CVEs. Fixed in 4.1.52.Final-tuxcare.1...

CLSA-2026-1776126839 TuxCare security update for io.netty (5 CVEs)

TuxCare rebuilt 40 io.netty packages to address 5 CVEs. Fixed in 4.1.48.Final-tuxcare.1...

CLSA-2025-1756253007 TuxCare security update for 38 packages (18 CVEs)

TuxCare rebuilt 38 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1...

Flowise RCE via TypeORM DataSource

============================================================================= Security Advisory elttam Topic: Flowise RCE via TypeORM DataSource Module: FlowiseAI/Flowise Disclosed: 15-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2 I. Background Flowise AI is an open-source, low-co...