https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T13:03:19.633473+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-43995 CVE-2026-43995 — Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) 2026-10-06T13:03:19.652743+00:00

Affected: FlowiseAI Flowise

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.