Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: berabuddies AgentFlow 1667fa3 Clear all filters
TI-2026-06562 CVE-2026-7466 · GHSA-9xfg-xjpc-86gf

AgentFlow Arbitrary Python Pipeline Execution via pipeline_path

Priority LOW 36

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipeline_path parameter to the POST /api/runs and POST /api/runs/va…

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00343 Published 2026-04-29 Fixed CWE-94
TI-2026-06540 CVE-2026-7439 · GHSA-7vgq-6q52-5p23

AgentFlow Local Web API Content-Type Validation Bypass

Priority MEDIUM 55

AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on s…

CVSS 4.0MEDIUM 4.8 Local No auth User interaction EPSS 0.00089 Published 2026-04-29 Fixed CWE-346