https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T11:05:10.741642+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-329220 EUVD-2026-329220 2026-10-04T11:05:10.745878+00:00 EUVD-2026-329220 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56275 fkie_cve-2026-56275 2026-10-04T11:05:10.745909+00:00

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud metadata, and enumerate internal services by exploiting the missing secureFetch verification in httpSecurity.ts.

 https://cve.radiocsirt.org/vuln/ghsa-9hrv-gvrv-6gf2 GHSA-9hrv-gvrv-6gf2 — Flowise Execute Flow function has an SSRF vulnerability 2026-10-04T11:05:10.745940+00:00

Affected: npm: flowise, npm: flowise-components

### Summary

The attacker provides an intranet address through the base url field configured in the Execute Flow node → Bypass checkDenyList / resolveAndValidate in httpSecurity.ts (not called) → Causes the server to initiate an HTTP request to any internal network address, read cloud metadata, or detect internal network services

### Details

<img width="1280" height="860" alt="9a52a74e6fe2fd78e4962d1d68057fc2" src="https://github.com/user-attachments/assets/20df0006-9129-4886-8928-16d19a617c23" />

Then initiate the call:

``` POST /api/v1/prediction/d6739838-d3b3-43d9-86ff-911a3d757a7e HTTP/1.1 Host: 127.0.0.1:3000 Content-Type: application/json Authorization: Bearer apikey Content-Length: 17

{"question": "1"} ```

Server received a request:

<img width="1432" height="172" alt="f45c757fec408e13739db068252ff21b" src="https://github.com/user-attachments/assets/d3dfe0f5-83ec-4c79-ab32-754382a68d5f" />

And there is an echo:

<img width="1280" height="666" alt="fa0caf0deb306cfeeea8fdf8941a287e" src="https://github.com/user-attachments/assets/55a94d25-120b-4e9c-9517-46c2fc2b667f" />

Fix: Call secureFetch for verification

### Impact

This is a Server-Side Request Forgery (SSRF) vulnerability that may lead to the following risks: - Explore Internal Web Applications - Access sensitive management interfaces - Leak internal configuration, credentials, or confidential information

This vulnerability significantly increases the risk of internal service enumeration and poten…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1145 WID-SEC-W-2026-1145 — Flowise: Mehrere Schwachstellen 2026-10-04T11:05:10.745994+00:00

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.