https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T00:34:02.337333+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-6125 CVE-2026-6125 — Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection 2026-10-17T00:34:02.338946+00:00

Affected: Dromara warm-flow

A security flaw has been discovered in Dromara warm-flow up to 1.8.4. Impacted is the function SpelHelper.parseExpression of the file /warm-flow/save-json of the component Workflow Definition Handler. The manipulation of the argument listenerPath/skipCondition/permissionFlag results in code injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.