The design flaw in Flowise’s Custom MCP node has allowed attackers to execute arbitrary JavaScript through unvalidated ...

Threat actors have started exploiting CVE-2025-59528, a critical Flowise vulnerability leading to remote code execution.

A supply-chain attack backdoored versions of Axios, a popular JavaScript library that's present in many different software ...

CVE-2025-59528 exploited in Flowise for over six months across 12,000+ exposed instances, enabling full system compromise.

The UAT-10608 hacking group is using automated scanning and scripts to exploit React2Shell in a large-scale credential ...

ThreatDown’s EDR team discovered a sophisticated, multi-stage attack chain during an active investigation; the first documented case of attackers abusing the Deno runtime as a malware execution ...

The Internet Bug Bounty program has paused new submissions, citing a massive expansion in vulnerability discovery by AI code ...

Wasm, PGlite, OPFS, and other new tech bring robust data storage to the browser, Electrobun brings Bun to desktop apps, ...