Threat Library

Flowise's OAuth2 credential refresh endpoint is exempt from authentication, allowing anyone who knows or guesses a credential ID to force the server to refresh and return a live OAuth access token for that connected third-party account. This lets attackers hijack victims' Google, Microsoft, GitHub, or other integrated service access without any login, and can also be abused to exhaust refresh token quotas as a denial-of-service.

Flowise's MCP security check uses a flag-blocklist and a four-item environment-variable blocklist to prevent malicious npx/node/python invocations, but npm's env-based configuration (e.g. npm_config_yes) reproduces blocked flag behavior and slips past the filter entirely. Because default Flowise deployments have no authentication, any unauthenticated attacker who can reach the Flowise API can supply an MCP server config that auto-installs and executes an arbitrary package, achieving remote code execution with the privileges of the Flowise process. This is a bypass of the prior fix for CVE-2025-8943, not a new class of bug.

Flowise's CSV Agent and Airtable Agent allow LLM-generated Python code to run inside a Pyodide sandbox, gated by a regex blacklist meant to block dangerous constructs like __class__ or __import__. Because JavaScript's regex word boundaries are ASCII-only while Python 3 normalizes Unicode homoglyph identifiers (e.g., mathematical bold letters) to their ASCII equivalents, attackers can craft identifiers that bypass the filter but execute as the forbidden built-ins in Python, leading to full arbitrary code execution on the host running Flowise.

Flowise's CSVAgent node builds a Python script by unsafely interpolating an attacker-controlled base64 segment from a CSV file's data URI, allowing an attacker to break out of the Python string literal. Because Pyodide is configured with default Node.js bridging (exposing eval and dynamic import), the injected code escapes the WASM sandbox entirely and executes arbitrary file system and OS command operations on the host running Flowise. Any user who can create or modify a chatflow can plant this payload, and once the chatflow is exposed via the public prediction API, any unauthenticated request triggers full host compromise.

The INC Ransomware group has become the dominant threat actor exploiting recently disclosed vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances, with a sharp increase in activity since early August 2026. Multiple victims have already been listed on the group's data leak site, indicating active and successful exploitation in the wild.

A critical command injection vulnerability affects GL-iNet GL-MT3000 routers up to firmware version 4.4.5, residing in the server.set_peer function of the wg-server.so native plugin exposed via /cgi-bin/glc. The flaw allows unauthenticated or low-privilege remote attackers to inject arbitrary OS commands through the public_key parameter, and a public exploit is already available, significantly increasing the risk of active exploitation.

A critical command injection vulnerability affects the s2s.enable_echo_server function within the s2s.so native plugin on GL-iNet GL-MT3000 routers up to version 4.4.5. The flaw allows unauthenticated remote attackers to inject arbitrary OS commands via the 'port' argument, and a public exploit is already available. Given the CVSS score of 9.8 and remote exploitability, affected devices are at immediate risk of full compromise.

Krayin CRM 2.2.4 contains a critical missing authentication vulnerability that allows unauthenticated attackers to overwrite the primary administrator account by exploiting a flaw in the installer middleware bypass logic. Successful exploitation grants full administrative access to all CRM data, including customer records, credentials, and any integrated API keys or tokens.

A critical remote code execution vulnerability exists in OpenEMR through 8.2.0, allowing authenticated administrators to inject PHP payloads into the categories database table via SQL manipulation. The payload is later executed through an unsanitized eval() call in the CategoryTree component, which can be triggered by unauthenticated or low-privilege pages, resulting in full command execution as the web server user.

A critical command injection vulnerability exists in the ovpn-client.so plugin of GL.iNet GL-MT3000 routers (up to firmware 4.4.5), reachable via the /cgi-bin/glc endpoint. An attacker can remotely inject OS commands through the Hostname parameter of the get_recommend_config function, potentially achieving full device compromise. The exploit has been publicly disclosed, increasing the likelihood of active exploitation.

CVE-2026-18577 is an authentication bypass in N-able N-central, a widely deployed remote monitoring and management (RMM) platform, resulting from an incomplete fix for the prior vulnerability CVE-2026-18556. CISA has added this flaw to its Known Exploited Vulnerabilities catalog with an unusually short remediation window, indicating active or imminent exploitation. Successful exploitation allows attackers to bypass authentication entirely and take over accounts within N-central.

A vulnerability in the shell tool of Amazon Strands Agents Tools (before v0.8.0) allows an attacker to craft a prompt that sets the 'non_interactive' parameter to true, bypassing the human consent gate designed to approve shell command execution. This enables remote actors to execute arbitrary OS commands on the agent's host without user approval, effectively turning a safety control into a no-op. This is a high-severity issue given the direct path from prompt injection to remote code execution.

Adobe has issued an emergency patch for a maximum-severity flaw (CVSS 10.0) in Campaign Classic, its enterprise marketing automation platform, caused by incorrect authorization checks. The vulnerability allows arbitrary code execution without any user interaction, making it a high-priority target for exploitation once details or a proof-of-concept become public.

ArcadeDB versions prior to 26.7.2 contain a critical authorization bypass vulnerability affecting HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. Unauthenticated or under-privileged attackers can access and manipulate arbitrary databases by directly invoking these endpoints with crafted database parameters, bypassing intended access controls. Given the CVSS score of 9.8, this vulnerability poses a severe risk of data theft, tampering, and destruction on any exposed ArcadeDB instance.

ArcadeDB versions prior to 26.7.2 contain a critical authorization flaw allowing any database user to execute arbitrary JavaScript via the SQL DEFINE FUNCTION statement with LANGUAGE js, bypassing intended admin-only scripting restrictions. This effectively grants remote code execution to any actor with database access, regardless of assigned privilege level.

ArcadeDB before version 26.7.2 contains a critical flaw in its ScriptTriggerExecutor that improperly whitelists java.lang.* packages, allowing an authenticated user with UPDATE_SCHEMA permission to craft a malicious JavaScript trigger. This trigger can invoke Java.type to access Runtime.getRuntime().exec() or ProcessBuilder, resulting in arbitrary OS command execution when the trigger fires.

A critical authorization bypass in the @better-auth/scim plugin allows an authenticated user to mint a SCIM token that collides with an existing SSO/SAML/OIDC/OAuth provider namespace, granting full read/write/delete access over unrelated user accounts and sessions. This enables account takeover, unauthorized profile/email rewriting, and mass deprovisioning across the identity system. Given the 9.9 CVSS score and low attack complexity, this is highly exploitable in any deployment using SCIM provisioning alongside social/SSO logins.

GitPython 3.1.50's protection against dangerous clone options (--upload-pack/-u) can be bypassed by passing the joined short-option form -u<value>, which the default unsafe-option gate fails to detect. Applications that pass attacker-influenced values into Repo.clone_from() with allow_unsafe_options=False are still vulnerable to arbitrary command execution during the clone operation. The issue is fixed in GitPython 3.1.51.

A March 2021 firmware integration error in Coinkite's Coldcard hardware wallet caused seed generation to rely on a deterministic software pseudorandom number generator (PRNG) instead of proper entropy sources, producing predictable private keys. Attackers exploited this weakness to systematically drain 1,196 Bitcoin addresses, stealing 1,082.65 BTC (~$70.2 million) in just 41 minutes on July 30. Galaxy Research identified the pattern and linked the mass sweep directly to the firmware defect, exposing years of latent risk for affected wallet holders.

A critical vulnerability in Ruby on Rails' Active Storage framework allows unauthenticated attackers to read arbitrary files from an affected application, with a potential escalation path to remote code execution. Rails maintainers have released patches, and organizations running unpatched Active Storage implementations should prioritize updates given the severity and ease of exploitation typically associated with such flaws.