Lucene search
+L

473262 matches found

CVE
CVE
added 2 days ago29 views

CVE-2026-69255

Flowise CVE-2026-69255 affects the CSVAgent component (packages/components/nodes/agents/CSVAgent/CSVAgent.ts) prior to version 3.1.3. The vulnerability stems from attacker-controlled CSV data being interpolated into a Python block via base64String = "${base64String}" after naively parsing CSV wit...

9.2CVSS6AI score0.00313EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2 days ago4 views

Critical: Red Hat Security Advisory: OpenShift Container Platform 4.21.27 bug fix and security update

Red Hat OpenShift Container Platform release 4.21.27 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...

10CVSS5.6AI score0.00808EPSS
SaveExploits4References6
RedHat Linux
RedHat Linux
added 2 days ago5 views

Important: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.10.1 release

Red Hat build of OpenTelemetry 3.10.1 has been released This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes. Breaking changes: None Deprecations: None Technology Preview features: None Enhancements: None Bug fixes: None Known issues: None...

9.8CVSS6.6AI score0.00813EPSS
SaveExploits2References15
Cvelist
Cvelist
added 2 days ago33 views

CVE-2026-69098 kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...

9.8CVSS0.00508EPSS
SaveExploits1References2
CVE
CVE
added 2 days ago35 views

CVE-2026-69253

Summary of findings (CVE-2026-69253). Flowise allowed in-process vm2 sandbox JavaScript execution for several tools (AgentAsTool, ChatflowTool, ExecuteFlow) with the baseURL injected into generated code, enabling code injection and sandbox escape. The vulnerability arises because baseURL validati...

9CVSS5.8AI score0.00312EPSS
SaveExploits0References4
EUVD
EUVD
added 2 days ago5 views

EUVD-2026-52739

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code, they inserted a user-controlled...

9CVSS5.8AI score0.00312EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2 days ago39 views

CVE-2026-69253 Flowise Sandbox Escape to RCE

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code, they inserted a user-controlled...

9CVSS0.00312EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2 days ago38 views

DataEase - Remote Code Execution

DataEase is an open-source business intelligence and data visualization platform. Public advisories state that CVE-2025-49002 is related to a bypass in the previous fix for CVE-2025-32966 involving case-insensitive handling of restricted H2 JDBC keywords. This template is a non-invasive detection...

9.8CVSS5.5AI score0.45022EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2 days ago50 views

n8n Webhooks - Remote Code Execution

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker,...

10CVSS8.2AI score0.71647EPSS
SaveExploits22References2
EUVD
EUVD
added 2 days ago5 views

EUVD-2026-52726

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...

7.2CVSS5.5AI score0.0026EPSS
SaveExploits0References4
CVE
CVE
added 2 days ago23 views

CVE-2026-69252

Flowise CVE-2026-69252: Before 3.1.3, the /api/v1/files route was protected only by feat:files and did not enforce checkPermission on GET/DELETE. A low-privileged, authenticated API key could list files under the organization root and delete files in other workspaces within the same organization ...

7.2CVSS5.5AI score0.0026EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2 days ago32 views

CVE-2026-69252 Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...

7.2CVSS0.0026EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2 days ago10 views

Flowise RCE via TypeORM DataSource

============================================================================= Security Advisory elttam Topic: Flowise RCE via TypeORM DataSource Module: FlowiseAI/Flowise Disclosed: 15-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2 I. Background Flowise AI is an open-source, low-co...

9CVSS6.2AI score0.00291EPSS
SaveExploits1References2Affected Software2
Patchstack
Patchstack
added 2 days ago7 views

NPM: Flowise RCE via TypeORM DataSource

NPM: Flowise RCE via TypeORM DataSource vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

9CVSS5.4AI score0.00291EPSS
SaveExploits1References2Affected Software1
Cvelist
Cvelist
added 2 days ago32 views

CVE-2026-69251 Flowise RCE via TypeORM DataSource

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...

9CVSS0.00291EPSS
SaveExploits1References1
CVE
CVE
added 2 days ago29 views

CVE-2026-69250

Summary: CVE-2026-69250 affects Flowise up to version 3.1.2 (pre-3.1.3). The OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is publicly whitelisted and unauthenticated. The endpoint performs a server-side HTTP request to a credential-controlled accessTokenUrl w...

8.5CVSS5.6AI score0.00342EPSS
SaveExploits0References3
CVE
CVE
added 2 days ago14 views

CVE-2026-18766

CVE-2026-18766 affects the chetans9 core-php-admin-panel (up to the commit 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f). The issue is a SQL injection caused by manipulation of the argument filter_col in customers.php. It can be exploited remotely, and the exploit has been published and may be used. ...

6.5CVSS6.4AI score0.00192EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2 days ago34 views

CVE-2026-18650 Missing Authorization Leading to Root Code Execution in HAVELSAN's Liman MYS

Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Privilege Escalation. This issue affects Liman MYS: from 2.2.3 before 2.3.1...

8.8CVSS0.00232EPSS
SaveExploits0References1
CVE
CVE
added 2 days ago17 views

CVE-2026-14337

CVE-2026-14337 affects Pega Platform versions 23.1.0 through 25.1.3, where a stored Cross-site Scripting (XSS) vulnerability exists in a user interface component. The flaw requires a high-privilege developer user and is described with a CVSS 4.0 base score of 4.6 (Medium). The provided data does ...

4.6CVSS5.4AI score0.00247EPSS
SaveExploits0References1
CVE
CVE
added 2 days ago18 views

CVE-2026-17070

Technical details such as affected product/version, root cause, and remediation are not publicly available in the provided documents; monitor for updates.

8.8CVSS5.4AI score0.00286EPSS
SaveExploits0References1
Rows per page
Query Builder