Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow…
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce …
OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by direc…
LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template f…
kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying …
Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.
Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size.
Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.
Memory Corruption while processing IOCTL device driver requests with invalid arguments.
Memory Corruption when handling malformed request parameters in the fingerprint TA.
Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.
Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
Memory Corruption when processing registry values with incorrect types using a direct query method.
Memory corruption while processing a packet with a size close to the maximum allowed value.
OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a maliciou…
A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function _check_slash_access of the file gateway/run.py of the component Quick Command Handler.…
The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument o…
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSourc…