Security advisories

high2026-08-04

CVE-2026-15307-Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

django/django · GHSA-wvqv-fj8w-qmhm

medium2026-08-04

CVE-2026-15830-Django GeoDjango vulnerable to denial of service through deeply nested geometry collections

django/django · GHSA-q238-5cxm-5c9h

high2026-08-04

CVE-2026-70474-Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

flowiseai/flowise · GHSA-wch5-xp77-fxg4

medium2026-08-04

Flowise: Incomplete Credential Redaction Exposes Secrets via API

flowiseai/flowise · GHSA-rwrp-9823-p2xq

high2026-08-04

CVE-2026-70473-Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

flowiseai/flowise · GHSA-fr6g-7cq8-fg82

high2026-08-04

CVE-2026-70472-Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

flowiseai/flowise · GHSA-chm3-vqcf-52rx

critical2026-08-04

CVE-2026-69264-Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

flowiseai/flowise · GHSA-4j8x-x6v7-w9rq

high2026-08-04

Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys

flowiseai/flowise · GHSA-88pr-878c-24wf

high2026-08-04

CVE-2026-70471-Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

flowiseai/flowise · GHSA-8r8h-6vcc-xhrv

critical2026-08-04

CVE-2026-70470-Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

flowiseai/flowise · GHSA-52fh-8v99-63c2

high2026-08-04

CVE-2026-69263-Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

flowiseai/flowise · GHSA-xc48-889x-5qmw

high2026-08-04

CVE-2026-69262-Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

flowiseai/flowise · GHSA-p5w8-m249-4r4v

critical2026-08-04

CVE-2026-69259-Flowise RCE via SQLite Record Manager Node

flowiseai/flowise · GHSA-x3hf-7cj6-3r4m

high2026-08-04

CVE-2026-69258-Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API

flowiseai/flowise · GHSA-6vh2-wg4h-4vwj

high2026-08-04

CVE-2026-69257-Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

flowiseai/flowise · GHSA-c6xh-wv4j-ppv5

critical2026-08-04

CVE-2026-69256-Flowise: Remote Code Execution Vulnerability in CSVAgent

flowiseai/flowise · GHSA-x6vm-w76m-8j7g

critical2026-08-04

CVE-2026-69255-Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

flowiseai/flowise · GHSA-vmv7-4m6c-3cg5

critical2026-08-04

CVE-2026-69254-Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

flowiseai/flowise · GHSA-3769-jgqc-cxm7

critical2026-08-04

CVE-2026-69253-Flowise Sandbox Escape to RCE

flowiseai/flowise · GHSA-wg86-r78f-74mp

high2026-08-04

CVE-2026-69252-Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

flowiseai/flowise · GHSA-wp74-f5hh-5f3r