https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 12 Jul 2026 13:48:16 +0000 https://vulnerability.circl.lu/sighting/23f1dc4b-9cb3-49ec-8ed4-8e3a1d8b4c68/export {"uuid": "23f1dc4b-9cb3-49ec-8ed4-8e3a1d8b4c68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41264", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqdjfnoyfi22", "content": "CVE-2026-41264: FlowiseAI's New Exploit Highlights Persistent Security Gaps #CVE2026 #FlowiseAI #CyberSecurity", "creation_timestamp": "2026-07-11T01:33:15.104252Z"} {"uuid": "23f1dc4b-9cb3-49ec-8ed4-8e3a1d8b4c68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41264", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqdjfnoyfi22", "content": "CVE-2026-41264: FlowiseAI's New Exploit Highlights Persistent Security Gaps #CVE2026 #FlowiseAI #CyberSecurity", "creation_timestamp": "2026-07-11T01:33:15.104252Z"} https://vulnerability.circl.lu/sighting/23f1dc4b-9cb3-49ec-8ed4-8e3a1d8b4c68/export Sat, 11 Jul 2026 01:33:15 +0000 https://vulnerability.circl.lu/sighting/6227aa2b-cf53-4ff1-9b5b-614c9fdff6ba/export {"uuid": "6227aa2b-cf53-4ff1-9b5b-614c9fdff6ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41264", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqdjfjxcqo2o", "content": "CVE-2026-41264 Exposes FlowiseAI CSV Agent to Unauthenticated Attacks #CVE2026 #FlowiseAI #CyberSecurity", "creation_timestamp": "2026-07-11T01:33:11.535370Z"} {"uuid": "6227aa2b-cf53-4ff1-9b5b-614c9fdff6ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41264", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqdjfjxcqo2o", "content": "CVE-2026-41264 Exposes FlowiseAI CSV Agent to Unauthenticated Attacks #CVE2026 #FlowiseAI #CyberSecurity", "creation_timestamp": "2026-07-11T01:33:11.535370Z"} https://vulnerability.circl.lu/sighting/6227aa2b-cf53-4ff1-9b5b-614c9fdff6ba/export Sat, 11 Jul 2026 01:33:11 +0000 https://vulnerability.circl.lu/sighting/db25d551-21af-4432-8e67-1070c48feff9/export {"uuid": "db25d551-21af-4432-8e67-1070c48feff9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41264", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqdjfgcx4g2o", "content": "CVE-2024-27822 and CVE-2026-41264 Expose Flaws in FlowiseAI and macOS \u2013 Who's Counting the Costs? #CVE2024 #CVE2026 #FlowiseAI", "creation_timestamp": "2026-07-11T01:33:07.177134Z"} {"uuid": "db25d551-21af-4432-8e67-1070c48feff9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41264", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqdjfgcx4g2o", "content": "CVE-2024-27822 and CVE-2026-41264 Expose Flaws in FlowiseAI and macOS \u2013 Who's Counting the Costs? #CVE2024 #CVE2026 #FlowiseAI", "creation_timestamp": "2026-07-11T01:33:07.177134Z"} https://vulnerability.circl.lu/sighting/db25d551-21af-4432-8e67-1070c48feff9/export Sat, 11 Jul 2026 01:33:07 +0000 https://vulnerability.circl.lu/sighting/8f55eec6-40a9-452e-ad14-e67073622a4e/export {"uuid": "8f55eec6-40a9-452e-ad14-e67073622a4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41264", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqdjfcsjhg2o", "content": "CVE-2026-41264 and CVE-2024-27822: Flawed Protections Expose Real Threats #CVE2026 #CVE2024 #CyberSecurity", "creation_timestamp": "2026-07-11T01:33:03.434249Z"} {"uuid": "8f55eec6-40a9-452e-ad14-e67073622a4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41264", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqdjfcsjhg2o", "content": "CVE-2026-41264 and CVE-2024-27822: Flawed Protections Expose Real Threats #CVE2026 #CVE2024 #CyberSecurity", "creation_timestamp": "2026-07-11T01:33:03.434249Z"} https://vulnerability.circl.lu/sighting/8f55eec6-40a9-452e-ad14-e67073622a4e/export Sat, 11 Jul 2026 01:33:03 +0000 https://vulnerability.circl.lu/sighting/8db89b68-e1c0-46c6-8410-856394f71abe/export {"uuid": "8db89b68-e1c0-46c6-8410-856394f71abe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41264", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqdjf6uyrm2p", "content": "CVE-2026-41264: FlowiseAI's Deep Flaw Offers Attackers Arbitrary Code Execution #CVE2026 #CyberSecurity #Vulnerability", "creation_timestamp": "2026-07-11T01:32:59.618546Z"} {"uuid": "8db89b68-e1c0-46c6-8410-856394f71abe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41264", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqdjf6uyrm2p", "content": "CVE-2026-41264: FlowiseAI's Deep Flaw Offers Attackers Arbitrary Code Execution #CVE2026 #CyberSecurity #Vulnerability", "creation_timestamp": "2026-07-11T01:32:59.618546Z"} https://vulnerability.circl.lu/sighting/8db89b68-e1c0-46c6-8410-856394f71abe/export Sat, 11 Jul 2026 01:32:59 +0000 https://vulnerability.circl.lu/sighting/28c999b9-2dbc-406e-b1e6-65f2dc4a71ec/export {"uuid": "28c999b9-2dbc-406e-b1e6-65f2dc4a71ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41264", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"zdi-disclosures\", \"Takahiro Yokoyama\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This vulnerability allows remote attackers to execute arbitrary code on affected installations of FlowiseAI Flowise.\\n Authentication is not required to exploit this vulnerability.\\n\\n The specific flaw exists within the run method of the CSV_Agents class.\\n The issue results from the lack of proper sandboxing when evaluating an LLM generated python script.\\n An attacker can leverage this vulnerability to execute code in the context of the user running the server.\", \"disclosure_date\": \"2026-04-22\", \"fullname\": \"exploit/multi/http/flowise_auth_rce_cve_2026_41264\", \"is_install_path\": true, \"mod_time\": \"2026-06-06 12:25:07 +0000\", \"name\": \"Flowise CSV Agent Prompt Injection RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/flowise_auth_rce_cve_2026_41264\", \"references\": [\"CVE-2026-41264\", \"GHSA-3hjv-c53m-58jj\"], \"rport\": 3000, \"session_types\": false, \"targets\": [\"Linux Command\", \"Windows Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-07-05T07:55:59.725929Z"} {"uuid": "28c999b9-2dbc-406e-b1e6-65f2dc4a71ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41264", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"zdi-disclosures\", \"Takahiro Yokoyama\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This vulnerability allows remote attackers to execute arbitrary code on affected installations of FlowiseAI Flowise.\\n Authentication is not required to exploit this vulnerability.\\n\\n The specific flaw exists within the run method of the CSV_Agents class.\\n The issue results from the lack of proper sandboxing when evaluating an LLM generated python script.\\n An attacker can leverage this vulnerability to execute code in the context of the user running the server.\", \"disclosure_date\": \"2026-04-22\", \"fullname\": \"exploit/multi/http/flowise_auth_rce_cve_2026_41264\", \"is_install_path\": true, \"mod_time\": \"2026-06-06 12:25:07 +0000\", \"name\": \"Flowise CSV Agent Prompt Injection RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/flowise_auth_rce_cve_2026_41264\", \"references\": [\"CVE-2026-41264\", \"GHSA-3hjv-c53m-58jj\"], \"rport\": 3000, \"session_types\": false, \"targets\": [\"Linux Command\", \"Windows Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-07-05T07:55:59.725929Z"} https://vulnerability.circl.lu/sighting/28c999b9-2dbc-406e-b1e6-65f2dc4a71ec/export Sun, 05 Jul 2026 07:55:59 +0000 https://vulnerability.circl.lu/sighting/da99882a-a9da-4ecf-8a20-6b8d051e6180/export {"uuid": "da99882a-a9da-4ecf-8a20-6b8d051e6180", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41264", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"zdi-disclosures\", \"Takahiro Yokoyama\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This vulnerability allows remote attackers to execute arbitrary code on affected installations of FlowiseAI Flowise.\\n Authentication is not required to exploit this vulnerability.\\n\\n The specific flaw exists within the run method of the CSV_Agents class.\\n The issue results from the lack of proper sandboxing when evaluating an LLM generated python script.\\n An attacker can leverage this vulnerability to execute code in the context of the user running the server.\", \"disclosure_date\": \"2026-04-22\", \"fullname\": \"exploit/multi/http/flowise_auth_rce_cve_2026_41264\", \"is_install_path\": true, \"mod_time\": \"2026-06-06 12:25:07 +0000\", \"name\": \"Flowise CSV Agent Prompt Injection RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/flowise_auth_rce_cve_2026_41264\", \"references\": [\"CVE-2026-41264\", \"GHSA-3hjv-c53m-58jj\"], \"rport\": 3000, \"session_types\": false, \"targets\": [\"Linux Command\", \"Windows Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-07-03T08:40:03.367903Z"} {"uuid": "da99882a-a9da-4ecf-8a20-6b8d051e6180", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41264", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"zdi-disclosures\", \"Takahiro Yokoyama\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This vulnerability allows remote attackers to execute arbitrary code on affected installations of FlowiseAI Flowise.\\n Authentication is not required to exploit this vulnerability.\\n\\n The specific flaw exists within the run method of the CSV_Agents class.\\n The issue results from the lack of proper sandboxing when evaluating an LLM generated python script.\\n An attacker can leverage this vulnerability to execute code in the context of the user running the server.\", \"disclosure_date\": \"2026-04-22\", \"fullname\": \"exploit/multi/http/flowise_auth_rce_cve_2026_41264\", \"is_install_path\": true, \"mod_time\": \"2026-06-06 12:25:07 +0000\", \"name\": \"Flowise CSV Agent Prompt Injection RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/flowise_auth_rce_cve_2026_41264\", \"references\": [\"CVE-2026-41264\", \"GHSA-3hjv-c53m-58jj\"], \"rport\": 3000, \"session_types\": false, \"targets\": [\"Linux Command\", \"Windows Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-07-03T08:40:03.367903Z"} https://vulnerability.circl.lu/sighting/da99882a-a9da-4ecf-8a20-6b8d051e6180/export Fri, 03 Jul 2026 08:40:03 +0000 https://vulnerability.circl.lu/sighting/f588181e-64ae-4b43-9b51-da32c8f87572/export {"uuid": "f588181e-64ae-4b43-9b51-da32c8f87572", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-41262", "type": "published-proof-of-concept", "source": "https://github.com/fleetdm/fleet/security/advisories/GHSA-gm7f-v959-fr2g", "content": "", "creation_timestamp": "2026-06-26T22:35:37.463698Z"} {"uuid": "f588181e-64ae-4b43-9b51-da32c8f87572", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-41262", "type": "published-proof-of-concept", "source": "https://github.com/fleetdm/fleet/security/advisories/GHSA-gm7f-v959-fr2g", "content": "", "creation_timestamp": "2026-06-26T22:35:37.463698Z"} https://vulnerability.circl.lu/sighting/f588181e-64ae-4b43-9b51-da32c8f87572/export Fri, 26 Jun 2026 22:35:37 +0000 https://vulnerability.circl.lu/sighting/c23f149b-252d-40dc-8186-437b3e478dce/export {"uuid": "c23f149b-252d-40dc-8186-437b3e478dce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41263", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mkqpzycnet2q", "content": "CVE-2026-41263 - Traefik: BasicAuth middleware: timing side-channel vulnerability\nCVE ID : CVE-2026-41263\n \n Published : April 30, 2026, 9:16 p.m. | 1\u00a0hour, 2\u00a0minutes ago\n \n Description : Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, an...", "creation_timestamp": "2026-04-30T23:05:25.891616Z"} {"uuid": "c23f149b-252d-40dc-8186-437b3e478dce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41263", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mkqpzycnet2q", "content": "CVE-2026-41263 - Traefik: BasicAuth middleware: timing side-channel vulnerability\nCVE ID : CVE-2026-41263\n \n Published : April 30, 2026, 9:16 p.m. | 1\u00a0hour, 2\u00a0minutes ago\n \n Description : Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, an...", "creation_timestamp": "2026-04-30T23:05:25.891616Z"} https://vulnerability.circl.lu/sighting/c23f149b-252d-40dc-8186-437b3e478dce/export Thu, 30 Apr 2026 23:05:25 +0000 https://vulnerability.circl.lu/sighting/b8e8d750-5889-4940-92b7-cf50e6fd3cc6/export {"uuid": "b8e8d750-5889-4940-92b7-cf50e6fd3cc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41267", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mkfcol2w4r2o", "content": "", "creation_timestamp": "2026-04-26T10:07:07.969747Z"} {"uuid": "b8e8d750-5889-4940-92b7-cf50e6fd3cc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41267", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mkfcol2w4r2o", "content": "", "creation_timestamp": "2026-04-26T10:07:07.969747Z"} https://vulnerability.circl.lu/sighting/b8e8d750-5889-4940-92b7-cf50e6fd3cc6/export Sun, 26 Apr 2026 10:07:07 +0000