473262 matches found
CVE-2026-69255
Flowise CVE-2026-69255 affects the CSVAgent component (packages/components/nodes/agents/CSVAgent/CSVAgent.ts) prior to version 3.1.3. The vulnerability stems from attacker-controlled CSV data being interpolated into a Python block via base64String = "${base64String}" after naively parsing CSV wit...
Critical: Red Hat Security Advisory: OpenShift Container Platform 4.21.27 bug fix and security update
Red Hat OpenShift Container Platform release 4.21.27 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...
Important: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.10.1 release
Red Hat build of OpenTelemetry 3.10.1 has been released This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes. Breaking changes: None Deprecations: None Technology Preview features: None Enhancements: None Bug fixes: None Known issues: None...
CVE-2026-69098 kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization
kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...
CVE-2026-69253
Summary of findings (CVE-2026-69253). Flowise allowed in-process vm2 sandbox JavaScript execution for several tools (AgentAsTool, ChatflowTool, ExecuteFlow) with the baseURL injected into generated code, enabling code injection and sandbox escape. The vulnerability arises because baseURL validati...
EUVD-2026-52739
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code, they inserted a user-controlled...
CVE-2026-69253 Flowise Sandbox Escape to RCE
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code, they inserted a user-controlled...
DataEase - Remote Code Execution
DataEase is an open-source business intelligence and data visualization platform. Public advisories state that CVE-2025-49002 is related to a bypass in the previous fix for CVE-2025-32966 involving case-insensitive handling of restricted H2 JDBC keywords. This template is a non-invasive detection...
n8n Webhooks - Remote Code Execution
n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker,...
EUVD-2026-52726
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...
CVE-2026-69252
Flowise CVE-2026-69252: Before 3.1.3, the /api/v1/files route was protected only by feat:files and did not enforce checkPermission on GET/DELETE. A low-privileged, authenticated API key could list files under the organization root and delete files in other workspaces within the same organization ...
CVE-2026-69252 Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...
Flowise RCE via TypeORM DataSource
============================================================================= Security Advisory elttam Topic: Flowise RCE via TypeORM DataSource Module: FlowiseAI/Flowise Disclosed: 15-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2 I. Background Flowise AI is an open-source, low-co...
NPM: Flowise RCE via TypeORM DataSource
NPM: Flowise RCE via TypeORM DataSource vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
CVE-2026-69251 Flowise RCE via TypeORM DataSource
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...
CVE-2026-69250
Summary: CVE-2026-69250 affects Flowise up to version 3.1.2 (pre-3.1.3). The OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is publicly whitelisted and unauthenticated. The endpoint performs a server-side HTTP request to a credential-controlled accessTokenUrl w...
CVE-2026-18766
CVE-2026-18766 affects the chetans9 core-php-admin-panel (up to the commit 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f). The issue is a SQL injection caused by manipulation of the argument filter_col in customers.php. It can be exploited remotely, and the exploit has been published and may be used. ...
CVE-2026-18650 Missing Authorization Leading to Root Code Execution in HAVELSAN's Liman MYS
Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Privilege Escalation. This issue affects Liman MYS: from 2.2.3 before 2.3.1...
CVE-2026-14337
CVE-2026-14337 affects Pega Platform versions 23.1.0 through 25.1.3, where a stored Cross-site Scripting (XSS) vulnerability exists in a user interface component. The flaw requires a high-privilege developer user and is described with a CVSS 4.0 base score of 4.6 (Medium). The provided data does ...