What’s Vulnerable › Vulnerabilities

CVE-2026-51897

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-01 · updated 2026-10-05
• Weakness: CWE-284

Description

RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution

References

• https://gist.github.com/Ro1ME/7101a09720c120fd4989705aa7c0b894
• https://gist.github.com/Ro1ME/7101a09720c120fd4989705aa7c0b894

Get alerted when CVE-2026-51897 or the next vulnerability affects your stack