https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T19:44:02.574890+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-41137 CVE-2026-41137 — Flowise: Code Injection in CSVAgent leads to Authenticated RCE 2026-10-06T19:44:02.940047+00:00

Affected: FlowiseAI Flowise, FlowiseAI flowise-components

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the server. This vulnerability is fixed in 3.1.0.