2 vulnerabilidades en IBM Langflow OSS 1.0.0 – 1.12.8
2 CVEs del mismo lote · 1 con PoC público.
IBM Langflow OSS 1.0.0 – 1.12.8
CVE · página 8 de 45
2 vulnerabilidades en IBM Langflow OSS 1.0.0 – 1.12.4
2 CVEs del mismo lote · 2 con PoC público.
IBM Langflow OSS 1.0.0 – 1.12.4
CVE-2026-19610
A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations.
CVE-2026-15564
Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed.
CVE-2026-118905
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions.
CVE-2026-118030
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services.
CVE-2026-117859
A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component.
CVE-2026-117688
A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution.
CVE-2026-117627
A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as…
CVE-2026-117548
A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as "commonName") instead of its canonical…
CVE-2025-62839
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync.
CVE-2026-117174
Rejected reason: VUL-2026-008368 為先回報之相同問題
CVE-2025-62841
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync.
CVE-2026-118686
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on…
CVE-2026-118683
MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a bundle's configs/logging.conf to logging.config.fileConfig that eval()s handler…
CVE-2026-118679
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing…
CVE-2026-118678
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named…
8 vulnerabilidades en n8n 1.123.85
8 CVEs del mismo lote.
n8n 1.123.85
CVE-2026-118649
n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table…
CVE-2026-111486
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-111478: Identificador rechazado por su autoridad de numeración
El CVE-2026-111478 fue retirado por su CNA y no representa una vulnerabilidad real; Shodan no registra hosts afectados.
CVE-2026-118578
A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder.
CVE-2026-118577
A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder.
CVE-2026-82411
Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned…
CVE-2026-75520
Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in…
CVE-2026-55561
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just…
CVE-2026-86983
A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length.
CVE-2026-85749
MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, D/domain-admin, and H/host roles, can release to inbox or…
CVE-2026-118644
n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow.
CVE-2026-84725
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate…
CVE-2026-106079
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor…
CVE-2026-103411
An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service…
CVE-2026-103408
A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a…
CVE-2026-42922
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution.
CVE-2026-109516: Salto de autenticación en Bot for Telegram on WooCommerce
Una vulnerabilidad crítica en el plugin Bot for Telegram on WooCommerce permite a atacantes tomar control de cualquier cuenta de WordPress, incluyendo administradores.
CVE-2026-103407
An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user…
CVE-2026-103403
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart…
CVE-2026-103402
An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache…
CVE-2026-103401
An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows…
CVE-2026-67187
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List…
CVE-2026-112357
GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave…
CVE-2026-118378
Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table…
CVE-2026-118377
mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks.
CVE-2026-118579
A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI.
CVE-2026-118690
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint.
CVE-2026-76418 — Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an…
CVE-2026-92797: Vulnerabilidad de CSRF en MemberPress para WordPress
Una falla de CSRF en el plugin MemberPress permite a atacantes cambiar el correo de usuarios autenticados y tomar control de sus cuentas.
CVE-2026-46300 — Linux Kernel Missing Initialization of a Variable Vulnerability
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to.
CVE-2026-41709 — Broadcom VMWare ESX Insufficient Logging Vulnerability
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
CVE-2025-66516
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection…