{"vulnerability": "cve-2025-5952", "sightings": [{"uuid": "6f6e1d25-a3da-4fb3-88f5-74c8c62137fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m6aoztvucx2a", "content": "", "creation_timestamp": "2025-11-22T21:02:33.984941Z"}, {"uuid": "8f3b8c7e-631c-41c7-afb2-5c75d63dd84b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m4lvabofbd2l", "content": "", "creation_timestamp": "2025-11-01T21:02:25.573494Z"}, {"uuid": "8ddd3543-91bf-4de5-b9d4-8fc28b3d5f45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59527", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lzhheynsrd2x", "content": "", "creation_timestamp": "2025-09-22T22:28:16.611687Z"}, {"uuid": "9aab11a3-7a0c-4eaf-bd69-a560cf10af61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-59528", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3lzhmmncqts2w", "content": "", "creation_timestamp": "2025-09-23T00:02:02.508069Z"}, {"uuid": "1a31dbb2-c854-4936-be3a-3aaa31e8bbb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59529", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3maej2rvwtt2g", "content": "", "creation_timestamp": "2025-12-19T20:16:43.614187Z"}, {"uuid": "e5979688-6ef3-43b7-ae0a-bc3c8d0009c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59529", "type": "seen", "source": "https://seclists.org/oss-sec/2025/q4/288", "content": "", "creation_timestamp": "2025-12-19T18:57:30.000000Z"}, {"uuid": "02deed1a-39ce-4871-8822-801843cc1897", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mirnk4evhu22", "content": "", "creation_timestamp": "2026-04-05T21:03:02.946135Z"}, {"uuid": "84be76d4-3f17-4dee-b141-0e14356ebb25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-59528.yaml", "content": "", "creation_timestamp": "2026-04-02T20:32:37.000000Z"}, {"uuid": "51d2ad13-6b9a-4319-bb89-017f27bf3100", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3miu5yzvoqp2p", "content": "", "creation_timestamp": "2026-04-06T21:03:15.459003Z"}, {"uuid": "2d381452-fde7-436e-bb4d-66aec0568998", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3miv57xg5fw42", "content": "", "creation_timestamp": "2026-04-07T06:21:45.778534Z"}, {"uuid": "df0e54d7-7405-4100-a36a-b73b0d49d27b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3miv67akktm2u", "content": "", "creation_timestamp": "2026-04-07T06:39:10.868067Z"}, {"uuid": "1fff9be9-0f2f-4ad9-8458-64cb5056df2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://thehackernews.com/2026/04/flowise-ai-agent-builder-under-active.html", "content": "", "creation_timestamp": "2026-04-07T03:56:00.000000Z"}, {"uuid": "bbc1cd47-ef24-4b8f-a430-813aa868fbf2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/solomonneas.dev/post/3mivqaiwcuk27", "content": "", "creation_timestamp": "2026-04-07T12:02:16.180148Z"}, {"uuid": "e22b5e98-cd21-4137-954d-d9c8e9bfe860", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://threatintel.cc/2026/04/07/flowise-ai-agent-builder-under.html", "content": "", "creation_timestamp": "2026-04-07T14:30:04.000000Z"}, {"uuid": "e5a41c7f-5c1d-40fe-869a-01f6bd556670", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3miwodht35h2z", "content": "", "creation_timestamp": "2026-04-07T21:00:37.143441Z"}, {"uuid": "82b13a96-07e4-4b6e-82fc-fb18e8c7bf1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/FunctionalProgramming.activitypub.awakari.com.ap.brid.gy/post/3miwoe3kjqaa2", "content": "", "creation_timestamp": "2026-04-07T21:01:23.737834Z"}, {"uuid": "2785afb9-29c0-463a-912c-92431dd84c75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3miworvt36p2r", "content": "", "creation_timestamp": "2026-04-07T21:08:40.851269Z"}, {"uuid": "9d9a0623-359b-4ee8-a53a-23ee9452d4e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mix4mg5lud22", "content": "", "creation_timestamp": "2026-04-08T01:16:05.037186Z"}, {"uuid": "801138cd-c62c-46a6-b357-4a9b396cbc10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mixaoxbf5327", "content": "", "creation_timestamp": "2026-04-08T02:30:30.104026Z"}, {"uuid": "047085d6-35f1-4932-b3be-61e7fef4353a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mixulyuzbk2u", "content": "", "creation_timestamp": "2026-04-08T08:25:20.476152Z"}, {"uuid": "64b57748-e439-4bda-9477-70201f8d1c7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "Telegram/i4Th3-qfHPrRxEPubQsx_tgczYzW3xhGs7IIz0Vj8tpPp0c", "content": "", "creation_timestamp": "2025-11-27T21:00:05.000000Z"}, {"uuid": "83b264e4-2554-43e7-b645-0c28a322f634", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-5952", "type": "published-proof-of-concept", "source": "Telegram/fpCirrWp0oU0Ex_5TyvxTvRDf_boiqPgLEDt6DbVLmZ6Csc", "content": "", "creation_timestamp": "2025-06-10T05:30:35.000000Z"}, {"uuid": "a6442414-f831-478a-a6f9-7efb8aaae295", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3miyck2jsg72j", "content": "", "creation_timestamp": "2026-04-08T12:34:48.142528Z"}, {"uuid": "07c4adf0-cea5-4b3e-85b6-52c149d6ffd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3miydfbwlg22q", "content": "", "creation_timestamp": "2026-04-08T12:50:02.000095Z"}, {"uuid": "ea991e00-a556-47ea-b020-f1f02610b58e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://www.acn.gov.it/portale/w/flowise-rilevato-sfruttamento-in-rete-della-cve-2025-59528", "content": "", "creation_timestamp": "2026-04-08T09:51:19.000000Z"}, {"uuid": "44240ffe-3800-49a2-9b15-35da74b74a32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-59528", "type": "exploited", "source": "https://www.linkedin.com/feed/update/urn:li:activity:7446686314562850817/", "content": "", "creation_timestamp": "2026-04-06T04:00:00.000000Z"}, {"uuid": "c721b184-9705-4edd-80ab-82c0c21fd6df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3miyjtn7dod2b", "content": "", "creation_timestamp": "2026-04-08T14:45:26.177720Z"}, {"uuid": "d0c8cb2c-efa1-440f-98c8-ba2f286a3621", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3miyrma3vde2x", "content": "", "creation_timestamp": "2026-04-08T17:04:28.101617Z"}, {"uuid": "4aa6f16d-60cc-4366-a099-1646724b4989", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3miywfuopu22q", "content": "", "creation_timestamp": "2026-04-08T18:30:22.600343Z"}, {"uuid": "b8c700b0-0974-4467-87a4-8580587ff3f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mj3zd2biqt27", "content": "", "creation_timestamp": "2026-04-10T00:00:27.702623Z"}, {"uuid": "d42b7b29-1041-4d59-975b-7b1cb20cf292", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "exploited", "source": "https://t.me/xakep_ru/19230", "content": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Flowise \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432 \u0430\u0442\u0430\u043a\u0430\u0445\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0430\u0442\u0430\u043a \u043d\u0430 \u0418\u0418-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 Flowise \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2025-59528, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e JavaScript-\u043a\u043e\u0434\u0430. \u042d\u0442\u043e\u0442 \u0431\u0430\u0433 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0435 10 \u0431\u0430\u043b\u043b\u043e\u0432 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS, \u0438 \u043e \u043d\u0435\u043c \u0431\u044b\u043b\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043b\u0443\u0433\u043e\u0434\u0430, \u043e\u0434\u043d\u0430\u043a\u043e \u0432 \u0441\u0435\u0442\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043e\u0442 12 000 \u0434\u043e 15 000 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 Flowise.\n\nhttps://xakep.ru/2026/04/10/flowise-attacks/", "creation_timestamp": "2026-04-10T15:41:14.000000Z"}, {"uuid": "c17274c2-4db3-4353-aadc-9c17744db437", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mj5qcwrtij2s", "content": "", "creation_timestamp": "2026-04-10T16:24:40.069412Z"}, {"uuid": "e1727eca-fcd9-4427-bca9-be900d57b42a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-59528", "type": "seen", "source": "https://bsky.app/profile/ai-nerd.bsky.social/post/3mjn2wvwvuy2w", "content": "", "creation_timestamp": "2026-04-16T18:44:50.082124Z"}, {"uuid": "4ec3efb9-6878-479a-a24d-a06be54331e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://gist.github.com/mrbrownstone07/2caf598e6f4230d711c7fbf7954c24bf", "content": "", "creation_timestamp": "2026-04-17T15:49:26.000000Z"}, {"uuid": "d9deba29-c8d5-41a1-afdb-d92e8935ff13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/79998", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a HTB\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a secopssite\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 9  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 2\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-12 13:45:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nHackTheBox (HTB) writeups and exploit kits: Silentium, VariaType, Fries, Garfield, Hercules, Kobold, Pirate, CCTV, DevArea, HiddenPath, LockedAway, Interpreter \u2014 CVE-2025-59528, CVE-2025-8110, CVE-2025-2945, CVE-2026-23520, CVE-2025-66034, CVE-2024-25082\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-12T14:00:04.000000Z"}, {"uuid": "efec20b1-10c1-46fa-97af-69ab02bb5c95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/60955", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aCVE-2025-59528\nURL\uff1ahttps://github.com/B1ack4sh/Blackash-CVE-2025-59528\n\n\u6807\u7b7e\uff1a#CVE-2025", "creation_timestamp": "2025-11-27T14:38:41.000000Z"}, {"uuid": "73c2711b-af8d-490d-a6ce-53254e592eff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "exploited", "source": "https://t.me/thehackernews/8751", "content": "\ud83d\uded1 Flowise has a CVSS 10.0 RCE flaw (CVE-2025-59528) now under active attack.\n\nA bug in MCP config lets attackers run JavaScript with full system access using just an API token. Over 12,000 exposed instances raise risk.\n\n\ud83d\udd17 Exploitation details \u2192 https://thehackernews.com/2026/04/flowise-ai-agent-builder-under-active.html", "creation_timestamp": "2026-04-07T06:00:05.000000Z"}, {"uuid": "8468bd8f-ba4d-457e-98ae-069edbfa6662", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://t.me/ctinow/248433", "content": "Attackers exploit critical Flowise flaw CVE-2025-59528 for remote code execution\nhttps://ift.tt/3FsBOlt", "creation_timestamp": "2026-04-07T20:59:51.000000Z"}, {"uuid": "1ffb0b21-11e4-467b-958d-cf7521050467", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "exploited", "source": "https://t.me/true_secator/8076", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 VulnCheck \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442 \u043e\u0431 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c \u0443\u0440\u043e\u0432\u043d\u0435\u043c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0432\u00a0Flowise, \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0418\u0418 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0440\u044f\u0434\u043e\u043c \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u0439.\n\n\u0420\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2025-59528 (CVSS: 10.0), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430.\n\n\u0423\u0437\u0435\u043b CustomMCP \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0432\u0432\u043e\u0434\u0438\u0442\u044c \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0432\u043d\u0435\u0448\u043d\u0435\u043c\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 MCP, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0441\u0442\u0440\u043e\u043a\u0443 mcpServerConfig \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u044d\u0442\u043e\u0433\u043e \u043e\u043d \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043a\u043e\u0434 JavaScript \u0431\u0435\u0437 \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\nFlowise \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0430, \u0447\u0442\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u043f\u0430\u0441\u043d\u044b\u043c \u043c\u043e\u0434\u0443\u043b\u044f\u043c, \u0442\u0430\u043a\u0438\u043c \u043a\u0430\u043a child_process (\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434) \u0438 fs (\u0444\u0430\u0439\u043b\u043e\u0432\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430), \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u043d \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441 \u043f\u043e\u043b\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0441\u0440\u0435\u0434\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Node.js.\n\n\u0418\u043d\u044b\u043c\u0438 \u0441\u043b\u043e\u0432\u0430\u043c\u0438, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 JavaScript \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Flowise, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u0442 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0434\u043e\u0441\u0442\u0443\u043f\u0443 \u043a \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u043c\u0430\u043d\u0434 \u0438 \u0443\u0442\u0435\u0447\u043a\u0435 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u041a\u0430\u043a \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0438 \u0432 Flowise, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0442\u043e\u043a\u0435\u043d API, \u044d\u0442\u043e \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u0443\u044e \u0443\u0433\u0440\u043e\u0437\u0443 \u0434\u043b\u044f \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0441\u0442\u0438 \u0431\u0438\u0437\u043d\u0435\u0441\u0430 \u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0432\u044b\u0440\u0430\u0437\u0438\u043b\u0430 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u043d\u043e\u0441\u0442\u044c \u041a\u0438\u043c \u0421\u0443 \u0425\u0451\u043d \u0437\u0430 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 3.0.6 \u043f\u0430\u043a\u0435\u0442\u0430 npm.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0434\u0430\u043d\u043d\u044b\u043c VulnCheck, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u043b\u0430\u0441\u044c \u0441 \u043e\u0434\u043d\u043e\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430 Starlink.\n\nCVE-2025-59528 - \u044d\u0442\u043e \u0443\u0436\u0435 \u0442\u0440\u0435\u0442\u044c\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Flowise, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445, \u043f\u043e\u0441\u043b\u0435 CVE-2025-8943 (CVSS: 9,8), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u041e\u0421, \u0438 CVE-2025-26319 (CVSS: 8,9), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432, \u0430 \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0438\u0442, \u0447\u0442\u043e \u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u0447\u0442\u043e\u0431\u044b \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c \u0435\u0435.\n\n\u041a \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043f\u043b\u043e\u0449\u0430\u0434\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u0438, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430, \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 12 000 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432, \u0447\u0442\u043e Flowise \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u043e\u0441\u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0446\u0435\u043b\u044c\u044e \u0434\u043b\u044f \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u044f, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0443\u0436\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u044e\u0442 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.", "creation_timestamp": "2026-04-07T18:20:05.000000Z"}, {"uuid": "18bc3806-a764-42ef-a669-b2c7c1e7ffc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "exploited", "source": "https://t.me/BleepingComputer/24408", "content": "\u200aMax severity Flowise RCE vulnerability now exploited in attacks\n\nHackers are exploiting a maximum-severity vulnerability, tracked as CVE-2025-59528, in the open-source platform Flowise for building custom LLM apps and agentic systems to execute arbitrary code. [...]\n\nhttps://www.bleepingcomputer.com/news/security/max-severity-flowise-rce-vulnerability-now-exploited-in-attacks/", "creation_timestamp": "2026-04-07T17:46:36.000000Z"}, {"uuid": "a9761ed1-40ca-4e0a-b823-405484ecbd88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "Telegram/S964UnaAzc4FW7CZCUbAm7wNqkztcWapRmtGqRf9U9sXCaA", "content": "", "creation_timestamp": "2026-04-12T03:00:07.000000Z"}, {"uuid": "f83dddd0-f26d-4913-bb28-645b00d36050", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "Telegram/jqsHB6FIdeMNMlYJLaE-SWbBIQ7X4SKPFQvaPULFC7d8_bM", "content": "", "creation_timestamp": "2026-04-14T15:00:07.000000Z"}, {"uuid": "752706b9-8b93-4364-b54a-6872b1e35f1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "exploited", "source": "Telegram/i80ChqxtCwMTCecuezPWlkw9fIB_SXz6drz3fdFtvVclrg", "content": "", "creation_timestamp": "2026-04-07T06:25:43.000000Z"}, {"uuid": "f4f1f1c6-14de-4865-bfb6-d3e9994f1515", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "exploited", "source": "Telegram/ODWflLMLbVvGfdid2lwnx3810JM3zyf3Y-tOOmeM1HYXGKaF", "content": "", "creation_timestamp": "2026-04-07T21:05:05.000000Z"}, {"uuid": "c1634028-fa4c-4f6b-9bd5-305e15d5ca03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-5952", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17829", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-5952\n\ud83d\udd25 CVSS Score: 6.9 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P)\n\ud83d\udd39 Description: A vulnerability, which was classified as critical, has been found in Zend.To up to 6.10-6 Beta. This issue affects the function exec of the file NSSDropoff.php. The manipulation of the argument file_1 leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 6.10-7 is able to address this issue. It is recommended to upgrade the affected component. This affects a rather old version of the software. The vendor recommends updating to the latest release.\n\ud83d\udccf Published: 2025-06-10T05:00:14.974Z\n\ud83d\udccf Modified: 2025-06-10T05:00:14.974Z\n\ud83d\udd17 References:\n1. https://vuldb.com/?id.311789\n2. https://vuldb.com/?ctiid.311789\n3. https://vuldb.com/?submit.589178\n4. https://matheuscezar.github.io/2025/05/24/0-day-in-zend-to.html", "creation_timestamp": "2025-06-10T05:29:48.000000Z"}, {"uuid": "fcdffa47-8964-45d0-8d85-b48cba140cc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "Telegram/pCo_ULdqtYm5JNcUwpHa2UncR4FyWF1uQHW0ymYDC6k2-2Y", "content": "", "creation_timestamp": "2026-04-15T09:00:05.000000Z"}, {"uuid": "d44b0521-d3bc-4d0d-afe5-400eb2fc8902", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://bsky.app/profile/hakksaww.bsky.social/post/3ml2ly6ysgp25", "content": "Already on our IOC corpus before launch:\n\n@iflow-mcp/watercrawl-watercrawl-mcp v1.3.0-1.3.4 = GlassWorm (Aikido)\n20+ MCP-named repos serving SmartLoader (URLhaus)\nCVE-2025-59528: mcpServerConfig exploit\n\nThe ecosystem's been targeted, just not counted.", "creation_timestamp": "2026-05-04T21:19:28.502731Z"}, {"uuid": "6c814b76-a247-455a-8e57-9d2314f3b003", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "Telegram/ZCILXLquzGbXFQcaZlOXv9dkF48Tloh98M2Ojf7eGNskguU", "content": "", "creation_timestamp": "2026-08-29T23:00:04.308023Z"}, {"uuid": "2879bac4-5c63-42b2-9c2f-8adf4f73e87f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "Telegram/Gb8E7051tk852HHDoXLjDtC-e550Fak_8ZYRyADH7od6Bkg", "content": "", "creation_timestamp": "2026-08-29T23:00:12.893931Z"}, {"uuid": "4f2e32a3-b3d0-4f4f-8bd9-928110116c20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "Telegram/ZCILXLquzGbXFQcaZlOXv9dkF48Tloh98M2Ojf7eGNskguU", "content": "", "creation_timestamp": "2026-08-30T00:00:09.748204Z"}, {"uuid": "ff9246ea-1ae9-4f95-bd5f-d9e3eaaec9fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "Telegram/M2s3PphtTCD9brru-X6QMyPesFMqQlhfbVnnLWpusEfiV5g", "content": "", "creation_timestamp": "2026-05-16T21:00:04.000000Z"}, {"uuid": "65cd396b-18a1-40c1-b615-2f2aae8e4cdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "Telegram/FMuj_IRa9WJxg8stLSMyK9s8hezzOoxBzO2QROQaixpXJv8", "content": "", "creation_timestamp": "2026-05-17T21:00:04.000000Z"}, {"uuid": "af03c5b2-5c39-4a62-aeeb-ddb39453d531", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "Telegram/wDwm6-AY-JX6nhNni9OQWjE6Au1_mqn06OkP8toYPUyKP30", "content": "", "creation_timestamp": "2026-08-12T08:00:05.878008Z"}, {"uuid": "cc6a34b1-c65b-4ee0-9235-597b6c2cc88a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "Telegram/vfcBtHfYWKeSWcSBr8gn075FsnSSHY37K2BPjCM8QUj3z5c", "content": "", "creation_timestamp": "2026-08-12T08:00:07.231946Z"}, {"uuid": "5dce8822-efb7-4819-aea8-ac32aefef0b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://t.me/GithubRedTeam/86822", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a HackTheBox-Silentium\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a SuriyaBoon\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-01 11:10:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nFull walkthrough of HackTheBox \"Silentium\" (Medium/Linux). Chains three CVEs: CVE-2025-58434 leaks a Flowise password reset token unauthenticated, enabling account takeover; CVE-2025-59528 achieves RCE via unsanitized CustomMCP node; env vars expose SSH credentials for lateral movement. CVE-2025-8110 exploits Gogs symlink write as root to escalate.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-01T12:08:23.000000Z"}, {"uuid": "26574459-eec6-49f1-b261-a93289f7bc66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://t.me/VulnerabilityNews/41735", "content": "Max severity Flowise RCE vulnerability now exploited in attacks\n\nHackers are exploiting a maximum-severity vulnerability, tracked as CVE-2025-59528, in the open-source platform Flowise for building custom LLM apps and agentic systems to execute arbitrary code. [...]\nhttps://www.bleepingcomputer.com/news/security/max-severity-flowise-rce-vulnerability-now-exploited-in-attacks/", "creation_timestamp": "2026-08-18T19:00:06.314336Z"}, {"uuid": "e1687baf-1c01-453c-838c-802c3427000f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "Telegram/pEOUYF8cGjnWnRNsVcTP1hWT8v0mLe1mBAfuN7qHOw-Q7YU", "content": "", "creation_timestamp": "2026-06-09T03:00:05.000000Z"}, {"uuid": "99d672d9-056a-4996-8946-3c5a8a59f496", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6fec5af1-bdae-4e72-b62f-ad6bd4e72f1c", "content": "", "creation_timestamp": "2026-06-19T12:45:35.684105Z"}, {"uuid": "fab6e94f-bf01-4fe0-b24b-81a7a7137f91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "Telegram/vfcBtHfYWKeSWcSBr8gn075FsnSSHY37K2BPjCM8QUj3z5c", "content": "", "creation_timestamp": "2026-08-13T00:00:10.270494Z"}, {"uuid": "f037eb1e-593c-455c-8f06-d28128629d42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "Telegram/wDwm6-AY-JX6nhNni9OQWjE6Au1_mqn06OkP8toYPUyKP30", "content": "", "creation_timestamp": "2026-08-13T00:00:11.568502Z"}, {"uuid": "3caabd7f-76d5-4955-9061-e214b9153163", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "exploited", "source": "https://t.me/VulnerabilityNews/41735", "content": "Max severity Flowise RCE vulnerability now exploited in attacks\n\nHackers are exploiting a maximum-severity vulnerability, tracked as CVE-2025-59528, in the open-source platform Flowise for building custom LLM apps and agentic systems to execute arbitrary code. [...]\nhttps://www.bleepingcomputer.com/news/security/max-severity-flowise-rce-vulnerability-now-exploited-in-attacks/", "creation_timestamp": "2026-08-19T00:00:07.681126Z"}, {"uuid": "441ba44c-7312-42a9-9359-d97c980d53ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://t.me/CyberDispatch/1224", "content": "Flowise has a CVSS 10.0 RCE flaw (CVE-2025-59528) now under active attack.\n\nA bug in MCP config lets attackers run JavaScript with full system access using just an API token. Over 12,000 exposed instances raise risk.", "creation_timestamp": "2026-08-29T20:00:18.105244Z"}, {"uuid": "d6f46b1f-0ec3-4a3b-9b48-e2cb07416d1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/87953", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC #Remote Code Execution\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2025-59528\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Moon-Harvest\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-09 00:42:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nGo Proof of Concept (PoC) exploit for Flowise CustomMCP Remote Code Execution (RCE) CVE-2025-59528\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-12T11:00:03.657175Z"}, {"uuid": "68df04fb-2efb-4aef-8b7e-45eed5a5e00c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "Telegram/Gb8E7051tk852HHDoXLjDtC-e550Fak_8ZYRyADH7od6Bkg", "content": "", "creation_timestamp": "2026-08-31T00:00:45.538668Z"}, {"uuid": "35a83c76-5d93-4618-8bcb-a4333babdfb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://t.me/critical_bug/1705", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 CVE-2025-59528: \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE \u0432 Flowise (CVSS 10.0)", "creation_timestamp": "2026-07-19T16:00:10.506441Z"}, {"uuid": "d2ed3030-5560-4b1f-856f-c5000fba7bcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://t.me/critical_bug/1704", "content": "\ud83d\udc31 HACKER VOICE \u2014 IM IN THE MAINFRAME\n\n\ud83d\udd25 CVE-2025-59528: Flowise \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d. CVSS 10.0 \u2014 \u043c\u0430\u043a\u0441\u0438\u043c\u0443\u043c! \ud83d\udd34\n\n\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Flowise \u2014 open-source \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f AI-\u0430\u0433\u0435\u043d\u0442\u043e\u0432. CVSS 10.0 \u2014 \u0430\u0431\u0441\u043e\u043b\u044e\u0442\u043d\u044b\u0439 \u043c\u0430\u043a\u0441\u0438\u043c\u0443\u043c! \ud83d\ude31\n\n\ud83d\udca5 \u0421\u0443\u0442\u044c \u0431\u0430\u0433\u0430:\n\u0423\u0437\u0435\u043b CustomMCP \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u0434\u043b\u044f MCP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 mcpServerConfig. \u0412\u043d\u0443\u0442\u0440\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 convertToValidJSONString \u0432\u0432\u043e\u0434 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0442\u043e\u0440 Function() \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u0430\u043a JavaScript \u0441 \u043f\u043e\u043b\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 Node.js. \u041d\u0438\u043a\u0430\u043a\u043e\u0439 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438, \u043d\u0438\u043a\u0430\u043a\u043e\u0439 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b.\n\n\u041e\u0434\u0438\u043d POST-\u0437\u0430\u043f\u0440\u043e\u0441 \u2192 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c.\n\n\ud83d\udea8 \u0418\u043c\u043f\u0430\u043a\u0442:\n\u2014 \u0412\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434\n\u2014 \u0414\u043e\u0441\u0442\u0443\u043f \u043a .env \u0441 \u043a\u043b\u044e\u0447\u0430\u043c\u0438 OpenAI, Anthropic, \u043f\u0430\u0440\u043e\u043b\u044f\u043c\u0438 \u0411\u0414\n\u2014 \u041a\u0440\u0430\u0436\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Shodan, \u0431\u043e\u043b\u0435\u0435 15 000 \u0438\u043d\u0441\u0442\u0430\u043d\u0441\u043e\u0432 Flowise \u043e\u0442\u043a\u0440\u044b\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442. \ud83e\udd2f\n\n\ud83d\udee1 \u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c?\n1\ufe0f\u20e3 \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Flowise \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 3.0.6 (\u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0441\u0435 \u2264 3.0.5)\n2\ufe0f\u20e3 \u0423\u0431\u0440\u0430\u0442\u044c API \u0438\u0437 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u2014 \u0442\u043e\u043b\u044c\u043a\u043e VPN\n3\ufe0f\u20e3 \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 POST \u043a /api/v1/node-load-method/customMCP\n4\ufe0f\u20e3 \u0421\u043c\u0435\u043d\u0438\u0442\u044c \u0432\u0441\u0435 API-\u043a\u043b\u044e\u0447\u0438 \u0438 \u043f\u0430\u0440\u043e\u043b\u0438 \u0411\u0414\n\n\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 PoC \u2014 \u0432 \u043f\u0440\u0438\u043a\u0440\u0435\u043f\u043b\u0451\u043d\u043d\u043e\u043c PDF! \ud83d\udc47\n\n\ud83d\udc8e \u042d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432\u043d\u044b\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u044b \u0440\u0430\u043d\u044c\u0448\u0435 \u0432\u0441\u0435\u0445 \u2014 VIP-\u0432\u0435\u0440\u0441\u0438\u044f: https://vip.eh.su \ud83d\ude80\n\n#Flowise #CVE #RCE #AI #ZeroDay #CyberSecurity #Infosec #critical_bug", "creation_timestamp": "2026-07-19T16:00:11.040749Z"}, {"uuid": "f62ed09d-a06e-4281-a0ce-d178890b790c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "https://t.me/critical_bug/1705", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 CVE-2025-59528: \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE \u0432 Flowise (CVSS 10.0)", "creation_timestamp": "2026-07-20T00:00:07.015380Z"}, {"uuid": "289475f0-a8da-4647-9bcd-1bf7cd8cac6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "exploited", "source": "https://t.me/critical_bug/1704", "content": "\ud83d\udc31 HACKER VOICE \u2014 IM IN THE MAINFRAME\n\n\ud83d\udd25 CVE-2025-59528: Flowise \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d. CVSS 10.0 \u2014 \u043c\u0430\u043a\u0441\u0438\u043c\u0443\u043c! \ud83d\udd34\n\n\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Flowise \u2014 open-source \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f AI-\u0430\u0433\u0435\u043d\u0442\u043e\u0432. CVSS 10.0 \u2014 \u0430\u0431\u0441\u043e\u043b\u044e\u0442\u043d\u044b\u0439 \u043c\u0430\u043a\u0441\u0438\u043c\u0443\u043c! \ud83d\ude31\n\n\ud83d\udca5 \u0421\u0443\u0442\u044c \u0431\u0430\u0433\u0430:\n\u0423\u0437\u0435\u043b CustomMCP \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u0434\u043b\u044f MCP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 mcpServerConfig. \u0412\u043d\u0443\u0442\u0440\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 convertToValidJSONString \u0432\u0432\u043e\u0434 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0442\u043e\u0440 Function() \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u0430\u043a JavaScript \u0441 \u043f\u043e\u043b\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 Node.js. \u041d\u0438\u043a\u0430\u043a\u043e\u0439 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438, \u043d\u0438\u043a\u0430\u043a\u043e\u0439 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b.\n\n\u041e\u0434\u0438\u043d POST-\u0437\u0430\u043f\u0440\u043e\u0441 \u2192 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c.\n\n\ud83d\udea8 \u0418\u043c\u043f\u0430\u043a\u0442:\n\u2014 \u0412\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434\n\u2014 \u0414\u043e\u0441\u0442\u0443\u043f \u043a .env \u0441 \u043a\u043b\u044e\u0447\u0430\u043c\u0438 OpenAI, Anthropic, \u043f\u0430\u0440\u043e\u043b\u044f\u043c\u0438 \u0411\u0414\n\u2014 \u041a\u0440\u0430\u0436\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Shodan, \u0431\u043e\u043b\u0435\u0435 15 000 \u0438\u043d\u0441\u0442\u0430\u043d\u0441\u043e\u0432 Flowise \u043e\u0442\u043a\u0440\u044b\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442. \ud83e\udd2f\n\n\ud83d\udee1 \u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c?\n1\ufe0f\u20e3 \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Flowise \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 3.0.6 (\u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0441\u0435 \u2264 3.0.5)\n2\ufe0f\u20e3 \u0423\u0431\u0440\u0430\u0442\u044c API \u0438\u0437 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u2014 \u0442\u043e\u043b\u044c\u043a\u043e VPN\n3\ufe0f\u20e3 \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 POST \u043a /api/v1/node-load-method/customMCP\n4\ufe0f\u20e3 \u0421\u043c\u0435\u043d\u0438\u0442\u044c \u0432\u0441\u0435 API-\u043a\u043b\u044e\u0447\u0438 \u0438 \u043f\u0430\u0440\u043e\u043b\u0438 \u0411\u0414\n\n\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 PoC \u2014 \u0432 \u043f\u0440\u0438\u043a\u0440\u0435\u043f\u043b\u0451\u043d\u043d\u043e\u043c PDF! \ud83d\udc47\n\n\ud83d\udc8e \u042d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432\u043d\u044b\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u044b \u0440\u0430\u043d\u044c\u0448\u0435 \u0432\u0441\u0435\u0445 \u2014 VIP-\u0432\u0435\u0440\u0441\u0438\u044f: https://vip.eh.su \ud83d\ude80\n\n#Flowise #CVE #RCE #AI #ZeroDay #CyberSecurity #Infosec #critical_bug", "creation_timestamp": "2026-07-21T00:00:41.199510Z"}, {"uuid": "b154c40d-d1f6-45ae-9f25-eb3352ef96b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/100101", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #YARA #rules\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a PoC-and-yara-rules-of-CVE-2025-59528-Flowise-has-Remote-Code-Execution-vulnerability\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a hackpatato\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-28 12:57:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\npoc and yara rules\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-29T00:00:08.526066Z"}, {"uuid": "31975171-a3dd-44c2-9ff1-ecad2bc70a13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://t.me/GithubRedTeam/100101", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #YARA #rules\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a PoC-and-yara-rules-of-CVE-2025-59528-Flowise-has-Remote-Code-Execution-vulnerability\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a hackpatato\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-28 12:57:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\npoc and yara rules\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-28T16:00:06.832347Z"}, {"uuid": "a10cf5cf-e0b9-48e9-bf65-2808ee499796", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://t.me/ZerodayAlert/652", "content": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u0418\u0418-\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 Flowise \u0443\u0436\u0435 \u0430\u0442\u0430\u043a\u0443\u0435\u0442\u0441\u044f\n\n8 \u0430\u043f\u0440\u0435\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 VulnCheck \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2025-59528 \u0432 Flowise \u2014 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0418\u0418-\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u0443\u044e \u043e\u0446\u0435\u043d\u043a\u0443 10 \u0438\u0437 10 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 JavaScript-\u043a\u043e\u0434 \u0441 \u0435\u0433\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442\u0441\u044f \u0432 \u043b\u043e\u0433\u0438\u043a\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0435\u0440\u0432\u0435\u0440\u0430 CustomMCP \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b. \u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043e\u0442 12 000 \u0434\u043e 15 000 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a Flowise, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432\u0441\u044f \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u0430\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0441 \u043e\u0434\u043d\u043e\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441\u043e \u0441\u043f\u0443\u0442\u043d\u0438\u043a\u043e\u0432\u044b\u043c \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u043e\u043c Starlink.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0437\u0430\u043a\u0440\u044b\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 Flowise 3.0.6, \u043e\u0434\u043d\u0430\u043a\u043e \u0434\u0430\u043b\u0435\u043a\u043e \u043d\u0435 \u0432\u0441\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0441\u043f\u0435\u043b\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435. \u041f\u043e\u043c\u0438\u043c\u043e CVE-2025-59528, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0435\u0449\u0451 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Flowise, \u0440\u0430\u043d\u0435\u0435 \u0442\u0430\u043a\u0436\u0435 \u0432\u043d\u0435\u0441\u0451\u043d\u043d\u044b\u0435 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445.\n\n#flowise #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u0418\u0418 #zeroday \n\n@ZerodayAlert", "creation_timestamp": "2026-07-25T15:00:08.316521Z"}, {"uuid": "f8c53e69-2c42-4c94-a87a-499d6b5be7d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "exploited", "source": "https://t.me/ZerodayAlert/652", "content": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u0418\u0418-\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 Flowise \u0443\u0436\u0435 \u0430\u0442\u0430\u043a\u0443\u0435\u0442\u0441\u044f\n\n8 \u0430\u043f\u0440\u0435\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 VulnCheck \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2025-59528 \u0432 Flowise \u2014 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0418\u0418-\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u0443\u044e \u043e\u0446\u0435\u043d\u043a\u0443 10 \u0438\u0437 10 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 JavaScript-\u043a\u043e\u0434 \u0441 \u0435\u0433\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442\u0441\u044f \u0432 \u043b\u043e\u0433\u0438\u043a\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0435\u0440\u0432\u0435\u0440\u0430 CustomMCP \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b. \u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043e\u0442 12 000 \u0434\u043e 15 000 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a Flowise, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432\u0441\u044f \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u0430\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0441 \u043e\u0434\u043d\u043e\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441\u043e \u0441\u043f\u0443\u0442\u043d\u0438\u043a\u043e\u0432\u044b\u043c \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u043e\u043c Starlink.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0437\u0430\u043a\u0440\u044b\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 Flowise 3.0.6, \u043e\u0434\u043d\u0430\u043a\u043e \u0434\u0430\u043b\u0435\u043a\u043e \u043d\u0435 \u0432\u0441\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0441\u043f\u0435\u043b\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435. \u041f\u043e\u043c\u0438\u043c\u043e CVE-2025-59528, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0435\u0449\u0451 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Flowise, \u0440\u0430\u043d\u0435\u0435 \u0442\u0430\u043a\u0436\u0435 \u0432\u043d\u0435\u0441\u0451\u043d\u043d\u044b\u0435 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445.\n\n#flowise #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u0418\u0418 #zeroday \n\n@ZerodayAlert", "creation_timestamp": "2026-07-26T00:00:36.214909Z"}, {"uuid": "9830f76b-e6f4-467e-8fe4-30327b34be1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://t.me/cyberwarehouse/1106", "content": "\ud83d\udc31 HACKER VOICE \u2014 IM IN THE MAINFRAME\n\n\ud83d\udd25 CVE-2025-59528: Flowise \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d. CVSS 10.0 \u2014 \u043c\u0430\u043a\u0441\u0438\u043c\u0443\u043c! \ud83d\udd34\n\n\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Flowise \u2014 open-source \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f AI-\u0430\u0433\u0435\u043d\u0442\u043e\u0432. CVSS 10.0 \u2014 \u0430\u0431\u0441\u043e\u043b\u044e\u0442\u043d\u044b\u0439 \u043c\u0430\u043a\u0441\u0438\u043c\u0443\u043c! \ud83d\ude31\n\n\ud83d\udca5 \u0421\u0443\u0442\u044c \u0431\u0430\u0433\u0430:\n\u0423\u0437\u0435\u043b CustomMCP \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u0434\u043b\u044f MCP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 mcpServerConfig. \u0412\u043d\u0443\u0442\u0440\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 convertToValidJSONString \u0432\u0432\u043e\u0434 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0442\u043e\u0440 Function() \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u0430\u043a JavaScript \u0441 \u043f\u043e\u043b\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 Node.js. \u041d\u0438\u043a\u0430\u043a\u043e\u0439 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438, \u043d\u0438\u043a\u0430\u043a\u043e\u0439 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b.\n\n\u041e\u0434\u0438\u043d POST-\u0437\u0430\u043f\u0440\u043e\u0441 \u2192 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c.\n\n\ud83d\udea8 \u0418\u043c\u043f\u0430\u043a\u0442:\n\u2014 \u0412\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434\n\u2014 \u0414\u043e\u0441\u0442\u0443\u043f \u043a .env \u0441 \u043a\u043b\u044e\u0447\u0430\u043c\u0438 OpenAI, Anthropic, \u043f\u0430\u0440\u043e\u043b\u044f\u043c\u0438 \u0411\u0414\n\u2014 \u041a\u0440\u0430\u0436\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Shodan, \u0431\u043e\u043b\u0435\u0435 15 000 \u0438\u043d\u0441\u0442\u0430\u043d\u0441\u043e\u0432 Flowise \u043e\u0442\u043a\u0440\u044b\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442. \ud83e\udd2f\n\n\ud83d\udee1 \u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c?\n1\ufe0f\u20e3 \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Flowise \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 3.0.6 (\u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0441\u0435 \u2264 3.0.5)\n2\ufe0f\u20e3 \u0423\u0431\u0440\u0430\u0442\u044c API \u0438\u0437 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u2014 \u0442\u043e\u043b\u044c\u043a\u043e VPN\n3\ufe0f\u20e3 \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 POST \u043a /api/v1/node-load-method/customMCP\n4\ufe0f\u20e3 \u0421\u043c\u0435\u043d\u0438\u0442\u044c \u0432\u0441\u0435 API-\u043a\u043b\u044e\u0447\u0438 \u0438 \u043f\u0430\u0440\u043e\u043b\u0438 \u0411\u0414\n\n\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 PoC \u2014 \u0432 \u043f\u0440\u0438\u043a\u0440\u0435\u043f\u043b\u0451\u043d\u043d\u043e\u043c PDF! \ud83d\udc47\n\n\ud83d\udc8e \u042d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432\u043d\u044b\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u044b \u0440\u0430\u043d\u044c\u0448\u0435 \u0432\u0441\u0435\u0445 \u2014 VIP-\u0432\u0435\u0440\u0441\u0438\u044f: https://vip.eh.su \ud83d\ude80\n\n#Flowise #CVE #RCE #AI #ZeroDay #CyberSecurity #Infosec #critical_bug", "creation_timestamp": "2026-07-26T02:00:06.284289Z"}, {"uuid": "9cf33a6b-8bf7-4bee-9579-a3b7480e58ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "https://t.me/cyberwarehouse/1106", "content": "\ud83d\udc31 HACKER VOICE \u2014 IM IN THE MAINFRAME\n\n\ud83d\udd25 CVE-2025-59528: Flowise \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d. CVSS 10.0 \u2014 \u043c\u0430\u043a\u0441\u0438\u043c\u0443\u043c! \ud83d\udd34\n\n\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Flowise \u2014 open-source \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f AI-\u0430\u0433\u0435\u043d\u0442\u043e\u0432. CVSS 10.0 \u2014 \u0430\u0431\u0441\u043e\u043b\u044e\u0442\u043d\u044b\u0439 \u043c\u0430\u043a\u0441\u0438\u043c\u0443\u043c! \ud83d\ude31\n\n\ud83d\udca5 \u0421\u0443\u0442\u044c \u0431\u0430\u0433\u0430:\n\u0423\u0437\u0435\u043b CustomMCP \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u0434\u043b\u044f MCP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 mcpServerConfig. \u0412\u043d\u0443\u0442\u0440\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 convertToValidJSONString \u0432\u0432\u043e\u0434 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0442\u043e\u0440 Function() \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u0430\u043a JavaScript \u0441 \u043f\u043e\u043b\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 Node.js. \u041d\u0438\u043a\u0430\u043a\u043e\u0439 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438, \u043d\u0438\u043a\u0430\u043a\u043e\u0439 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b.\n\n\u041e\u0434\u0438\u043d POST-\u0437\u0430\u043f\u0440\u043e\u0441 \u2192 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c.\n\n\ud83d\udea8 \u0418\u043c\u043f\u0430\u043a\u0442:\n\u2014 \u0412\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434\n\u2014 \u0414\u043e\u0441\u0442\u0443\u043f \u043a .env \u0441 \u043a\u043b\u044e\u0447\u0430\u043c\u0438 OpenAI, Anthropic, \u043f\u0430\u0440\u043e\u043b\u044f\u043c\u0438 \u0411\u0414\n\u2014 \u041a\u0440\u0430\u0436\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Shodan, \u0431\u043e\u043b\u0435\u0435 15 000 \u0438\u043d\u0441\u0442\u0430\u043d\u0441\u043e\u0432 Flowise \u043e\u0442\u043a\u0440\u044b\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442. \ud83e\udd2f\n\n\ud83d\udee1 \u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c?\n1\ufe0f\u20e3 \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Flowise \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 3.0.6 (\u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0441\u0435 \u2264 3.0.5)\n2\ufe0f\u20e3 \u0423\u0431\u0440\u0430\u0442\u044c API \u0438\u0437 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u2014 \u0442\u043e\u043b\u044c\u043a\u043e VPN\n3\ufe0f\u20e3 \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 POST \u043a /api/v1/node-load-method/customMCP\n4\ufe0f\u20e3 \u0421\u043c\u0435\u043d\u0438\u0442\u044c \u0432\u0441\u0435 API-\u043a\u043b\u044e\u0447\u0438 \u0438 \u043f\u0430\u0440\u043e\u043b\u0438 \u0411\u0414\n\n\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 PoC \u2014 \u0432 \u043f\u0440\u0438\u043a\u0440\u0435\u043f\u043b\u0451\u043d\u043d\u043e\u043c PDF! \ud83d\udc47\n\n\ud83d\udc8e \u042d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432\u043d\u044b\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u044b \u0440\u0430\u043d\u044c\u0448\u0435 \u0432\u0441\u0435\u0445 \u2014 VIP-\u0432\u0435\u0440\u0441\u0438\u044f: https://vip.eh.su \ud83d\ude80\n\n#Flowise #CVE #RCE #AI #ZeroDay #CyberSecurity #Infosec #critical_bug", "creation_timestamp": "2026-07-27T00:00:34.482158Z"}, {"uuid": "0c214552-13eb-4a5a-bd62-5b51f0c9e9af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "exploited", "source": "https://t.me/CyberDispatch/1224", "content": "Flowise has a CVSS 10.0 RCE flaw (CVE-2025-59528) now under active attack.\n\nA bug in MCP config lets attackers run JavaScript with full system access using just an API token. Over 12,000 exposed instances raise risk.", "creation_timestamp": "2026-08-31T00:00:26.405529Z"}, {"uuid": "11e40931-e851-4fa1-8525-798a011ede26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/flowise_js_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Kim SooHyun (im-soohyun)\", \"nltt0\", \"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a remote code execution vulnerability in Flowise versions >= 2.2.7-patch.1\\n          and < 3.0.6. The vulnerability exists in the customMCP endpoint (/api/v1/node-load-method/customMCP)\\n          located in packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts, which allows users to execute\\n          arbitrary commands via JavaScript code injection in the mcpServerConfig parameter using the\\n          convertToValidJSONString function that uses Function('return ' + inputString)(). For versions < 3.0.1,\\n          the exploit can work unauthenticated if FLOWISE_USERNAME and FLOWISE_PASSWORD environment variables\\n          are not configured. For versions >= 3.0.1, authentication via FLOWISE_EMAIL and FLOWISE_PASSWORD is\\n          required due to JWT token verification.\", \"disclosure_date\": \"2025-09-13\", \"fullname\": \"exploit/multi/http/flowise_js_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Flowise JS Injection RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/flowise_js_rce.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/flowise_js_rce\", \"references\": [\"CVE-2025-59528\", \"EDB-52440\"], \"rport\": 3000, \"session_types\": false, \"targets\": [\"Unix/Linux Command\", \"Windows Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:46.901877Z"}, {"uuid": "87bcef68-e3d4-47db-a2c4-4603a6bbee5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102799", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC #Remote Code Execution\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Flowise-RCE-CVE-2025-59528\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a arensballiu\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-19 19:44:34\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAuthenticated Remote Code Execution (RCE) exploit for Flowise AI versions \u2264 3.0.4. Leverages a vulnerability in the /api/v1/node-load-method/customMCP endpoint to execute arbitrary system commands via Node.js child_process.execSync(). Includes full PoC script and remediation steps.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-19T22:00:04.712940Z"}, {"uuid": "25c0deb4-5ae7-4f3a-93b9-212608b115c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "Telegram/Y8oaEwOM76G3WMRt3xRBjYc4NY3q7Pzf3TFytYOOr2BNMYE", "content": "", "creation_timestamp": "2026-09-20T00:00:06.740716Z"}, {"uuid": "c56e4486-5246-46cd-abd6-3ed6833dc6c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "Telegram/3VMPoGezX0__VYfLOkEwkBbWcqI9BlMWeYwG7xmpOTdUw3M", "content": "", "creation_timestamp": "2026-09-25T09:18:03.000000Z"}, {"uuid": "fba8c6ce-d6a7-46f2-8299-64e1e77eb44d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "published-proof-of-concept", "source": "Telegram/3VMPoGezX0__VYfLOkEwkBbWcqI9BlMWeYwG7xmpOTdUw3M", "content": "", "creation_timestamp": "2026-09-25T09:18:03.000000Z"}, {"uuid": "957e4287-2b66-4d01-a97a-9c9478f0bd26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59528", "type": "seen", "source": "https://gist.github.com/OurTeamSpace/5a5c7de87558041e64ed8bc43fb2c20f", "content": "# Research: Iran-proof server + sanctions-bypass architecture (Issue #3)\n\nDate: 2026-10-02 | Branch: `research/iran-server` | Scope: single-server-first spec for Morph Mag agentic pipeline\n\n## TL;DR recommendation\n\n- **1\u00d7 VPS first, not multi-server.** Start: **4 vCPU / 8 GB RAM / 100\u2013160 GB NVMe, ~\u20ac6\u201315/mo**, in **Frankfurt/Amsterdam (primary) or Istanbul (lowest latency to Iran)**. Scale vertically to 16 GB before ever adding a second box.\n- **Host: Moldova/offshore provider with crypto + no US-KYC friction** \u2014 shortlist **AlexHost (Moldova, since 2008)** or **PQ.Hosting / THE.Hosting (Moldova, since 2019)**. Avoid Hetzner/US hosts as the *account holder* path for an Iran-linked team.\n- **OS: Ubuntu 24.04 LTS**. Stack: **Docker Engine + Docker Compose, Caddy (reverse proxy + auto-HTTPS), Coolify (ops UI), n8n (queue mode: main + worker + Postgres 16 + Redis 7), Beszel + Uptime Kuma (monitoring), MinIO (S3 file store), Qdrant/pgvector (embeddings, only when RAG lands)**.\n- **Sanctions bypass is two-sided:** (a) Iran DPI blocks/fingerprints VPNs + throttles foreign IPs \u2192 need **VLESS-Reality / Hysteria2 / TUIC-v5 on port 443** with clean exit; (b) US providers (OpenAI/Anthropic/Google) block Iranian IPs/accounts per OFAC \u2192 **server calls APIs from non-sanctioned exit IP + non-Iranian account/payment; Iranian editors never touch upstream directly** \u2014 they use the VPS-hosted dashboard/API gateway.\n- **Dashboards beyond n8n:** keep n8n for automation, add **Coolify (deploy dashboard), Beszel (docker/host metrics), Uptime Kuma (uptime + public status), Flowise or Langflow (LLM/RAG visual builder), Open WebUI (model chat playground)**. Grafana only later.\n- **If restrictions lift:** keep same Compose files, split to 2\u20133 nodes (apps / workers+GPU / data), move secrets to managed vault, add managed DB/object storage, swap proxy gateway for direct API keys + billing.\n\n## 1. Problem framing: two block directions\n\n1. **Iran \u2192 world (filternet + DPI).** Deep packet inspection fingerprints OpenVPN/WireGuard/L2TP and throttles; only traffic mimicking real HTTPS (VLESS-Reality, Hysteria2 over QUIC, TUIC v5, Shadowsocks-2022 + WS/TLS plugin) reliably passes in 2026. Port 443 + valid TLS fingerprint + CDN masking are load-bearing.\n2. **World \u2192 Iran (OFAC + vendor ToS).** OpenAI blocks Russia/Iran/Cuba/Syria/NK; Anthropic bars Iran/Syria/Cuba/NK/Russia (~158 supported regions only) and **checks source IP on every request** (not just login); Google binds account country. Iranian phone numbers/cards fail signup/billing. Separately, US hosting ToS (e.g. Database Mart: \"cannot provide hosting services to customers in Iran, North Korea, Sudan, Cuba, Venezuela, Russia\") shows why a US account/host is fragile.\n3. **Consequence for architecture:** the VPS must live in a *supported* country, owned via a *non-sanctioned identity/payment*, and Iranian clients reach *the VPS* (via obfuscated tunnel), while *the VPS* reaches *model APIs*. Never expose Iranian IPs to upstream.\n\nExisting Iran pattern proving this works: gateways like `1xai.ir` present one OpenAI-compatible base URL (`api.openai.com` \u2192 `1xai.ir/v1`), route by model name to OpenAI/Anthropic/Gemini, bill in Toman via Zarinpal, and hide client IP/UA from upstream. We self-host the same pattern (LiteLLM / Open WebUI + API gateway) rather than depending on a third-party reseller.\n\n## 2. Hosting company decision\n\n### Avoid as primary (documented risk)\n\n- **Hetzner (DE/FI):** cheap (CX23 ~\u20ac5.49/mo ex-VAT post-June-2026: 2 shared vCPU/4 GB/40 GB/20 TB) but (a) strict KYC/verification, (b) ~10% of German Hetzner IPs reported blocked by GCP/AWS/Azure because prior tenants used them for Iran sanction-busting traffic redirection (Cloud66 report, 2024-06-03), causing collateral IP-reputation damage, (c) RU/IR-targeted throttling waves observed mid-2025 on Hetzner/OVH/Cloudflare ranges. Good hardware, wrong risk profile for this ticket.\n- **Any US-only host / US hyperscaler account:** ToS explicitly refuses sanctioned-country customers; account + payment must be non-Iranian and stay that way.\n\n### Shortlist (sanctions-neutral + crypto)\n\n| Provider | Base / since | Why it fits | Caveats | Entry price |\n|---|---|---|---|---|\n| **AlexHost** | Moldova / 2008, DCs in MD + NL/SE/BG/FR/CH/UK/RO/US | Offshore, DMCA-ignore, **anonymous-friendly / no-KYC positioning**, 50+ cryptos via Cryptomus/CoinGate (BTC, USDT, XMR, etc.), KVM + NVMe, own ISO support | Cheapest tiers are E5-class shared cores; Ryzen tiers cost more; verify current plan before order | ~\u20ac6/mo Linux 1-core/1.5 GB/10 GB NVMe; Ryzen 2-core/30 GB ~\u20ac15/mo |\n| **PQ.Hosting (THE.Hosting)** | Moldova / 2019, 37\u201342 countries, 150k+ clients | **Crypto accepted**, NVMe KVM, 1 Gbps unlimited on many tiers, Linux-literate support, wide location choice (DE/NL/TR-adjacent) | No formal uptime SLA (~99.99% observed); dated panel, strict refund/KYC complaints \u2014 start on monthly, test first | ~\u20ac6/mo Aluminium (1 vCore/1 GB/25 GB NVMe) |\n| Fallbacks: Zomro (NL/DE, from \u20ac5.95), EDIS Global (Equinix AM6 Amsterdam, from \u20ac4.99), VerticHost (25+ DCs) | EU | Useful if AlexHost/PQ capacity is constrained; re-check crypto + KYC at order time | Not specifically offshore-anonymous | varies |\n\n**Location order:** **Frankfurt or Amsterdam first** (best peering, model-API latency, clean-IP pools; MonoVM 2026 latency map shows Frankfurt 0\u20132 ms to Exness-Frankfurt, Amsterdam 1\u20132 ms to FXTM-Amsterdam as proxies for EU interconnect quality), **Istanbul second** if editor-to-server latency dominates (\u224833\u201336 ms Frankfurt\u2192Istanbul reference; Istanbul is geographically closest to Iran). Avoid US/Asia exits for model calls (higher latency, stricter scrutiny). Order monthly, snapshot before any upgrade, test IP reputation on arrival (see \u00a77).\n\n## 3. Single-server-first spec\n\nRule from Coolify/multi-app sizing guides: platform overhead ~0.75\u20131.2 GB (Coolify + Traefik/Caddy + Docker + OS) before workloads; n8n idle ~150 MB, production ~512 MB; Postgres/Redis/MinIO each 128 MB\u20131 GB depending on load. Queue-mode n8n template caps total ~7.3 GB across 4 containers, so **4 GB RAM without swap cannot run the full template + anything else**.\n\n| Tier | Spec | Fits | Price band |\n|---|---|---|---|\n| **Start (recommended)** | **4 vCPU / 8 GB RAM / 100\u2013160 GB NVMe / 1 IPv4 + IPv6, \u226520 TB or unlimited, 1 Gbps** | Coolify + Caddy + n8n queue-mode + Postgres + Redis + Beszel + Uptime Kuma + MinIO + 1 Next.js/Ghost site | ~\u20ac8\u201320/mo offshore |\n| Floor (only if cash-constrained) | 2 vCPU / 4 GB RAM + 4 GB swap / 80 GB NVMe | n8n queue-mode alone, no co-located Next.js/SSR; swap is mandatory, expect pressure on image-heavy workflows | ~\u20ac6/mo |\n| Next vertical step | 6\u20138 vCPU / 16 GB / 200\u2013400 GB NVMe | Adds Flowise/Langflow + Qdrant + staging | ~\u20ac20\u201340/mo |\n\nDisk floor: 40 GB small stack / 80 GB medium / 160 GB+ full production (per MassiveGRID 2026 sizing). Always enable provider snapshots/backups + off-box S3 copy.\n\n**Single vs multi verdict: single.** Multi-server (control-plane + app + data nodes) only pays off past ~32 GB / 8\u201316 vCPU, or when staging + prod + GPU inference must be isolated. Single box = one firewall, one backup, same-LAN latency between app\u2194DB, lowest ops cost for Phase 1 (content pipeline per CONTEXT.md: research + content + archiving + distribution). Coolify natively supports promoting to multi-server later without re-platforming.\n\n## 4. OS + software stack\n\n- **OS: Ubuntu 24.04 LTS (Noble).** Required by Coolify install docs (LTS 20.04/22.04/24.04; non-LTS needs manual install), widest Docker/Caddy support, cloud images current as of Sept 2026. Use `amd64`, ext4 or ZFS, unattended-upgrades on.\n- **Container runtime: Docker Engine (official APT repo, not Snap) + Docker Compose v2.** Coolify installs/manages this; Snap-Docker is explicitly unsupported.\n- **Reverse proxy + TLS: Caddy 2 (caddy:2-alpine container or Ubuntu `caddy` package 2.6.2).** Automatic Let's Encrypt/ZeroSSL, HTTP/1.1+2 (+experimental 3), simple Caddyfile. Alternative Traefik comes inside Coolify \u2014 either is fine, but standardize on one (Caddy recommended for readability).\n- **Ops UI: Coolify (needs 2 cores / 2 GB / 30 GB minimum; comfortable at the 8 GB tier).** One-click n8n/Postgres/Redis templates, Git deploy for site, env management, built-in reverse proxy. Debian/Ubuntu/RedHat/SUSE/Arch/Alpine supported.\n- **Automation: n8n in queue mode** \u2014 `n8n main + n8n-worker + postgres:16-alpine + redis:7-alpine`, `EXECUTIONS_MODE=queue`, `EXECUTIONS_DATA_PRUNE` 14-day/10k cap, memory caps (main 2.5\u20133 GB, worker 3.5\u20134 GB, pg 700 MB, redis 500\u2013800 MB) + `NODE_OPTIONS --max-old-space-size` matched. SQLite only for throwaway tests.\n- **File store: MinIO (S3-compatible) or Coolify volumes + S3 backup.** System of record stays Markdown/XML files per CONTEXT.md \"Local file store\" \u2014 MinIO is the S3 skin over that, not a database mandate.\n- **Data: Postgres 16 for n8n/Coolify metadata; Qdrant or pgvector only when RAG ships.** No DB in Phase 1 unless research proves otherwise (per CONTEXT.md) \u2014 Postgres here is infra metadata, not content store.\n- **Tunnels: X-UI / Marzban + VLESS-Reality (port 443, Chrome/Firefox JA3/h2 fingerprint, real SNI front like microsoft.com/cdn.cloudflare.com), plus Hysteria2 fallback.** sing-box clients for editors; route `openai.com/chatgpt.com/oaistatic.com`, `claude.ai/anthropic.com`, model API hosts through tunnel; keep one stable exit country per session (critical for Claude per-request IP checks).\n- **Model gateway (self-hosted 1xai-pattern): LiteLLM or OpenRouter-style proxy on the VPS** \u2014 one key + one base URL for editors/agents, server-side fan-out to OpenAI/Anthropic/Gemini/DeepSeek with Toman/internal accounting. SDK-compatible (`base_url=https://llm./v1`).\n- **Secrets: env files + Coolify encrypted envs now; Vault/SOPS later.** `N8N_ENCRYPTION_KEY`, API keys, tunnel UUIDs never in git.\n- **Firewall: UFW 22/80/443 only; close 8000/3000-series dashboards to Tailscale/tunnel; SSH key-only, root-password off; automatic security updates.**\n\n## 5. Visual dashboards beyond n8n (recommended combo)\n\nn8n stays (400+ integrations, best self-host Docker story) but it is **automation**, not monitoring or LLM-playground. Add:\n\n| Need | Pick | Why / cost |\n|---|---|---|\n| Deploy + service dashboard | **Coolify** | Already required; replaces hand-rolled Compose/Traefik UI |\n| Host + Docker metrics | **Beszel** (hub + agent, MIT, PocketBase-based) | Lighter than Netdata/Grafana; per-container CPU/mem/net history, alerts, S3 backups; ~tens of MB |\n| Uptime + status page | **Uptime Kuma** (MIT, louislam) | HTTP/TCP/DNS/Ping + 90+ notifiers (Telegram/Discord/Slack), public status page; SQLite default; ~60\u2013128 MB |\n| LLM/RAG visual builder | **Flowise** (Apache-2.0, Node/LangChain.js, AgentFlow V2 + human-in-the-loop) for fast chatbot/RAG demos; or **Langflow** (MIT, Python/FastAPI, MCP-server export) if team is Python-first | Both MIT/Apache \u2014 embeddable commercially, unlike n8n Sustainable Use License which needs a commercial agreement for SaaS resale / external-user-triggered workflows |\n| Chat playground | **Open WebUI + Ollama** | Humanize/translate editors test prompts without touching vendor consoles |\n| Later / optional | Grafana + Prometheus, Langfuse/LangSmith (LLM tracing), Plausible (analytics), Gitea (git), Sim Studio (Apache-2.0 visual agent builder, K8s-ready) | Only when Phase 2 (growth/ops) demands it |\n\nSecurity note: every visual builder is a remote-code-execution surface by design \u2014 Langflow CVE-2025-3248 (CVSS 9.8, Flodrix botnet), Flowise CVE-2025-59528 (CVSS 10.0) + second import-RCE. Keep all builders behind login + private network, never public-anon.\n\n## 6. Sanctions-bypass runbook (minimal, Phase 1)\n\n1. Provision offshore VPS (monthly, Frankfurt/Amsterdam) with crypto; harden Ubuntu 24.04; install Caddy + Docker + Coolify.\n2. Deploy n8n queue-mode + Postgres + Redis via Coolify template with memory caps + pruning.\n3. Deploy VLESS-Reality + Hysteria2 on 443; issue per-editor configs (sing-box); pin one exit country; verify `openai.com/claude.ai` reachability from Iran-side client.\n4. Create non-Iranian provider accounts + foreign billing **once, outside Iran**, store keys only on VPS; all model traffic originates from VPS exit IP. Enforce: editors use `https://llm./v1` gateway, never vendor keys.\n5. Keep Iranian client IPs hidden from upstream (gateway strips IP/cookies/UA \u2014 same privacy claim as 1xai.ir).\n6. Backups: provider snapshot + nightly Postgres dump + MinIO mirror to second S3/off-box.\n7. IP hygiene: on delivery, check ASN (avoid AS16509/AS8075/AS24940/AS16276/AS14061-flagged ranges for model calls), MaxMind/IPQS score, and a test `GET /v1/models` via gateway; rotate/rebuild if CAPTCHA-looped or 403 on clean account.\n\n## 7. If restrictions lift (next steps)\n\n- Keep Compose files portable \u2014 lift means **billing/identity simplification, not re-architecture**: switch gateway to direct vendor keys, add per-seat billing, drop reseller margin.\n- Split vertically first (8 GB \u2192 16 GB), then horizontally: Node-1 control-plane + dashboards, Node-2 app/workers, Node-3 data (Postgres/MINIO/Qdrant on dedicated IOPS). Coolify multi-server mode supports this.\n- Adopt managed Postgres/object storage + CDN (Cloudflare) for the public magazine site; keep origin offshore until traffic analysis says otherwise.\n- Add SSO/SAML, audit logs, Kubernetes/queue autoscale (n8n enterprise features), SOC2-minded logging (Langfuse + Grafana) \u2014 only then.\n- Re-evaluate Hetzner/OVH/US clouds on price once KYC/ToS friction is gone; current offshore box becomes staging/fallback.\n\n## Sources (primary-first)\n\n- Coolify self-host requirements + supported OS (2 cores/2 GB/10\u201330 GB; Ubuntu LTS): `coolify.io/docs/start-with-self-hosted`\n- n8n sizing (idle ~100 MB, workflows drive RAM; 320 MB\u20132 GB range): `docs.n8n.io/deploy/host-n8n/.../prerequisites`\n- Production n8n queue-mode memory budgets (4 GB + swap floor, 8 GB comfortable; container/heap caps): `nextgrowth.ai/n8n-queue-mode-coolify/` (2026-01-02)\n- Coolify single-VPS install + Hetzner CX23 spec drift (2 vCPU/4 GB/40 GB/20 TB; \u20ac5.49 ex-VAT post-2026-06-15): `kirako.ai/en/blog/self-hosted-stack-hetzner-coolify-n8n` (2026-02-11)\n- Multi-app RAM math (overhead ~1 GB; Next.js/Postgres/Redis/n8n table; 4 GB min / 8 GB comfortable): `massivegrid.com/blog/coolify-resource-planning-multiple-apps/` (2026-02-26)\n- Hetzner sanction-busting IP collateral (~10% DE IPs blocked by GCP/AWS/Azure): `blog.cloud66.com/hetzner-connectivity-issues-due-to-sanction-busting-activities` (2024-06-03)\n- US host refusal for sanctioned countries (IR/KP/SD/CU/VE/RU): `databasemart.com/faq/general-questions`\n- OFAC Iran sanctions program: `state.gov/iran-sanctions`; Federal Register OFAC actions 2025-2026\n- RKN throttling wave on Hetzner/OVH/Cloudflare (June\u2013July 2025, 16 KB stall): `pxsl.ru/blog/...hetzner-i-ovh...`\n- OpenAI geo/OFAC blocks + proxy guidance: `ltesocks.io/blog/proxies-and-openai...` (2026-02-10); AnonymFlow VPN/ChatGPT 2026 (ASN + reputation + behavior layers)\n- Claude per-request IP checks + Iran unsupported (~158 regions): `univista.me/guide/claude-access-iran/` (2026-07-06); ChatGPT Iran shared-IP risk: `univista.me/guide/chatgpt-access-iran/` (2026-06-09); Fexyn Stealth/VLESS guidance for IR/RU/CN\n- Iran DPI + VLESS-Reality/Hysteria2/TUIC-v5/Shadowsocks-2022 guidance: `valebyte.com/en/blog/vps-for-bypassing-blocks-in-iran-what-works-in-2026/` (2026-07-04)\n- 1xai.ir gateway pattern (one key/base-URL, Toman/Zarinpal, IP hidden): `1xai.ir/` + `pypi.org/project/1xai-sdk/`\n- AlexHost offshore/crypto/no-KYC positioning: `btc-vps.com/bitcoin-vps/alexhost`, `websiteplanet.com/web-hosting/alexhost`, `hostservio.com/review/alexhost-user-review`\n- PQ.Hosting profile (Moldova 2019, 37+ countries, ~\u20ac6/mo, crypto, no SLA): `top30forexbrokers.com/product/pq-hosting-review` (2026-05-15)\n- EU latency references: `monovm.com/forex-vps/` (Geekbench + broker latency map, re-tested 2026-07-14); EDIS Amsterdam Equinix AM6 looking glass\n- n8n vs Flowise vs Langflow roles/licenses (n8n Sustainable Use fair-code; Flowise Apache-2.0; Langflow MIT; Flowise\u2192Workday 2025-08; Langflow/DataStax\u2192IBM May 2025; Langflow Cloud shutdown 2026-04-09): `blckalpaca.at/.../langflow-vs-flowise-vs-n8n` (2026-06-09), `huggingface.co/blog/daya-shankar/n8n-vs-flowise-vs-langflow-enterprises` (2026-04-27), `dreaming.press/posts/2026-06-21...`, `madappgang.com/blog/...` (2026-05-17), `altaitools.com/n8n-vs-flowise-vs-langflow/` (2026-08-13), `meetrix.io/blogs/flowise-vs-langflow-vs-n8n/` (2026-07-22)\n- Beszel (MIT, hub+agent, Docker stats, alerts): `beszel.dev/` + `github.com/henrygd/beszel`; Uptime Kuma (HTTP/TCP/DNS, 90+ notifiers, status pages): `github.com/louislam/uptime-kuma`, `uptimekuma.co/`; Beszel-vs-Kuma complementary roles: `instapods.com/apps/beszel/vs/uptime-kuma`\n- Ubuntu 24.04 LTS Noble + Caddy 2.6.2 packaging: `cloud-images.ubuntu.com/.../noble/release`, `packages.ubuntu.com/noble/caddy`, `launchpad.net/ubuntu/noble/+source/caddy`\n", "creation_timestamp": "2026-10-02T19:16:05.000000Z"}]}