https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T23:41:35.251013+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-03234 bdu:2026-03234 2026-10-05T23:41:35.256724+00:00 bdu:2026-03234 https://cve.radiocsirt.org/vuln/euvd-2026-250084 EUVD-2026-250084 2026-10-05T23:41:35.256756+00:00 EUVD-2026-250084 https://cve.radiocsirt.org/vuln/fkie_cve-2025-8943 fkie_cve-2025-8943 2026-10-05T23:41:35.256770+00:00

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.

 https://cve.radiocsirt.org/vuln/ghsa-2vv2-3x8x-4gv7 GHSA-2vv2-3x8x-4gv7 — Flowise OS command remote code execution 2026-10-05T23:41:35.256801+00:00

Affected: npm: flowise

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1836 WID-SEC-W-2025-1836 — Flowise: Mehrere Schwachstellen ermöglichen Codeausführung 2026-10-05T23:41:35.256827+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Programmcode oder Kommandos auszuführen.