478121 matches found
Important: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.10.1 release
Red Hat build of OpenTelemetry 3.10.1 has been released This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes. Breaking changes: None Deprecations: None Technology Preview features: None Enhancements: None Bug fixes: None Known issues: None...
CVE-2026-69098 kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization
kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...
EUVD-2026-52739
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code, they inserted a user-controlled...
CVE-2026-69253 Flowise Sandbox Escape to RCE
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code, they inserted a user-controlled...
CVE-2026-69253
Summary of findings (CVE-2026-69253). Flowise allowed in-process vm2 sandbox JavaScript execution for several tools (AgentAsTool, ChatflowTool, ExecuteFlow) with the baseURL injected into generated code, enabling code injection and sandbox escape. The vulnerability arises because baseURL validati...
GHSA-WG86-R78F-74MP Flowise Sandbox Escape to RCE
============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm...
EUVD-2026-52726
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...
CVE-2026-69252
Flowise CVE-2026-69252: Before 3.1.3, the /api/v1/files route was protected only by feat:files and did not enforce checkPermission on GET/DELETE. A low-privileged, authenticated API key could list files under the organization root and delete files in other workspaces within the same organization ...
CVE-2026-69252 Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...
CLSA-2026-1785727930 TuxCare security update for org.assertj:assertj-core (1 CVE)
TuxCare rebuilt org.assertj:assertj-core to address 1 CVE. Fixed in 3.11.1-tuxcare.1...
CLSA-2026-1785815205 TuxCare security update for org.springframework (24 CVEs)
TuxCare rebuilt 22 org.springframework packages to address 24 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.2...
CLSA-2026-1785380881 TuxCare security update for ws (2 CVEs)
TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.16.0-tuxcare.2...
CLSA-2026-1785468082 TuxCare security update for lodash-es (6 CVEs)
TuxCare rebuilt lodash-es to address 6 CVEs. Fixed in 4.17.15-tuxcare.1...
CLSA-2026-1785554485 TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.6-tuxcare.6...
CLSA-2026-1785380788 TuxCare security update for protobufjs (11 CVEs)
TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 1.5.1-tuxcare.1...
CLSA-2026-1785204576 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.5-tuxcare.2...
CLSA-2026-1785204347 TuxCare security update for karma (3 CVEs)
TuxCare rebuilt karma to address 3 CVEs. Fixed in 1.5.0-tuxcare.1...
CLSA-2026-1785380760 TuxCare security update for axios (7 CVEs)
TuxCare rebuilt axios to address 7 CVEs. Fixed in 1.7.9-tuxcare.3...