CVE-2026-40933

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

June 1, 2026

Last Seen

September 15, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical RCE Vulnerability Discovered in Flowise's MCP Implementation72.0

Obsidian Security identified a critical one-click remote code execution (RCE) vulnerability in Flowise (CVE-2026-40933), affecting self-hosted deployments. The flaw allows attackers to execute arbitrary server-side code by importing malicious chatflows, compromising server environments and sensitive...

Exposed AI Supply Chain Endpoints Present Security Risks51.9

A recent study revealed 36,769 self-hosted AI endpoints are exposed on the internet, with only 2.02% protected by HTTP authentication. The research conducted by Mysterium VPN indicates that running AI locally does not guarantee security, as many infrastructures are publicly accessible. The most conc...