New that day
- criticalpatched Payload: SQL Injection in SQLite and Postgres payload (npm) ### Impact A user can submit a request that exploits a SQL Injection vulnerability in Payload. You are affected if: - You use an affected Payload version. - Untrusted users can query readable collections using dynamic filters or joins. You are not affected if you use MongoDB (`@payloadcms/mongodb`). ### Patches Users should upgrade Payload packages to…
- criticalpatched Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation langflow (pip) ### Summary Langflow's built-in Python interpreter components — `PythonREPLComponent` (Python Interpreter) and the legacy `PythonREPLToolComponent` (Python REPL Tool) — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the code ran in-process with the privileges of the Langflow service, any…