www.vulncheck.com Remote Code Execution Vulnerabilities in Flowise and Spug Applications
Article Content
- •Flowise and Spug applications have critical remote code execution vulnerabilities.
- •Affected versions are Flowise before 3.1.4 and Spug through 3.4.0.
- •CWE-78 indicates improper neutralization of OS commands, enabling potential exploits.
Two separate remote code execution vulnerabilities have been identified in Flowise and Spug applications. Flowise versions before 3.1.4 and Spug versions through 3.4.0 are affected by CWE-78, which allows OS command injection. Attackers can exploit these vulnerabilities to execute arbitrary commands on the host system. The vulnerabilities were disclosed in advisories published on September 15 and September 13, 2026, respectively. No specific CVEs were mentioned in the articles. Organizations using these applications are advised to prioritize patching. The scope of impact includes any systems running the affected versions of Flowise and Spug. Current status indicates that these vulnerabilities are known but exploitation details remain unclear.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Continue Reading
Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and… Critical Zero-Day Vulnerability in Cisco Secure Email Gateway Exploited On September 14, 2026, Cisco disclosed a critical SQL injection vulnerability (CVE-2026-76461) in its Secure Email Gateway, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges. This vulnerability arises from insufficient validation in the email parsing logic. Cisco confirmed…