Cybersecurity, Compliance & Risk Advisory for the Digital Age
R4IM helps organizations strengthen security, achieve ISO compliance, manage cyber risk, and respond faster to emerging vulnerabilities — through practical, business-focused advisory services.
- IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to…Critical
- Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.High
- An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.1…Medium
Know what's exploited today. Act before it hits you.
Stay informed about critical vulnerabilities, actively exploited CVEs, vendor advisories, and emerging cyber risks. R4IM continuously monitors trusted public sources and simplifies the actions organizations should take.
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to…
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.
An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.1…
An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker on the WLAN to bypass captive portal authentication.
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows.
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table by id only; callback and refresh are whitelisted from authentication. This allows any authenticated user to initiate OAuth2 flows against credentials belonging to other workspaces, allows an unauthenticated attacker to forge OAuth2 callbacks to overwrite tokens in any credential, and allows an unauthenticated attacker to refresh tokens for any credential. The affected routes include /api/v1/oauth2-credential/authorize/<VICTIM_CREDENTIAL_UUID>, /api/v1/oauth2-credential/callback?code=ATTACKER_AUTH_CODE&state=<VICTIM_CREDENTIAL_UUID>, and /api/v1/oauth2-credential/refresh/<VICTIM_CREDENTIAL_UUID>. This issue is fixed in version 3.1.3.
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows.
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB and includes sensitive configuration data, including Vector Store settings such as Qdrant Server URL and collection name. The observed behavior indicates missing or insufficient authorization checks, workspace/project/tenant isolation, and pagination or limits, exposing integration parameters and infrastructure details that may enable further targeted attacks. This issue is fixed in version 3.1.3.
Flowise is a drag & drop user interface to build a customized large language model flow.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise openai-assistants-vector-store endpoints accept a client-controlled credential parameter and load credentials by id without checking whether that credential belongs to the caller workspace. Route permissions assistants:* only check feature access. The controller passes req.query.credential straight to the service, and the service uses findOneBy({ id: credentialId }), decrypts the credential, and calls OpenAI APIs without a workspaceId check. If an attacker knows another workspace credentialId, the attacker can use that workspace OpenAI key, read, modify, or delete victim vector stores and files, cause billing impact on the victim OpenAI account, and violate multi-tenant boundaries. This issue is fixed in version 3.1.3.
Built around your real risks, not a template.
Senior consultants. Practical recommendations. Outcomes that hold up to audits, boards, and adversaries alike.
ISO 27001 & ISMS Consulting
Build an audit-ready information security management system that stands up to scrutiny — not just at certification.
ISO 22301 & Business Continuity
Keep operations running through cyber incidents, outages, and disruption with tested continuity plans.
Vulnerability Assessment & Pentesting
Find and fix the vulnerabilities attackers will exploit — with prioritized, business-aligned remediation.
GRC & Risk Management
A practical governance, risk, and compliance program that gives leadership real visibility and control.
Cloud Security Advisory
Secure your AWS, Azure, and M365 environments against misconfiguration, identity, and data exposure risks.
ITSM & ISO 20000 Consulting
Mature IT service management with ITIL-aligned processes that improve uptime, change control, and user trust.
Meet ISO360
The all-in-one platform to plan, implement, and sustain ISO compliance.
Built by R4IM consultants for security, quality, and business continuity teams. ISO360 streamlines controls, evidence, risk, audits, and continual improvement across ISO 27001, ISO 22301, ISO 20000, and more — in one workspace.
- Multi-standard control library
- Evidence & document management
- Risk register & treatment plans
- Internal audits & CAPAs
- Real-time compliance dashboards
- Team collaboration & workflows
Practical advisory.
Audit-ready outcomes.
We work shoulder-to-shoulder with your teams to close compliance gaps, reduce cyber risk, and build security programs your auditors and your board can both trust. Two decades of UAE and global experience across ISO, cybersecurity, cloud, and GRC.
Get a clear next step on your cyber & compliance roadmap.
A senior R4IM advisor will reply within one business day. UAE-based teams available for on-site engagements across the region.