IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute...
CVE-2026-18729
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to impro
2026-08-30 归档
今日共收录 849 条安全情报，包含 76 个 CVE，428 篇安全通告，以及 85 篇研究论文。
← 返回归档列表IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows...
CVE-2026-18891
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive info
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due...
CVE-2026-18899
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.
IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This...
CVE-2026-18545
IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticat
IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions...
CVE-2025-64649
IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle te
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic...
CVE-2025-36271
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could a
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly...
CVE-2025-36290
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate valid
MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
CVE-2026-55855
### Summary A SQL injection is possible when the connector escapes Buffer parameters client-side under a multi-byte cli
RestrictedPython guard hooks can be shadowed via positional-only arguments
CVE-2026-55830
### Impact RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes `_getattr
Snipe-IT has an Improper Privilege Management issue
CVE-2026-55843
## Impact The `update()` method in `UsersController` passes the `permission` request field unconditionally to `Normaliz
MapFish Print has XXE that allows reading arbitrary files of certain types
CVE-2026-55848
### Summary XXE on MapFish Print allows reading arbitrary files of certain types. Eg /etc/passwd or k8 secrets and certs
silverstripe/versioned has XSS in archive admin restore
CVE-2026-55779
### Impact It's possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin ### Reporter Stev
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
CVE-2026-55873
### Summary SeaweedFS routes requests signed with SigV4 service `s3tables` to the S3Tables management API. Authorization
klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply
CVE-2026-55764
## Summary On the SFT add-quantity path the only supply bound is `SFTAddCirculation`, which does `meta.Circulation += am
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits
CVE-2026-55763
## Summary In `processPercentageRoyaltiesTransfer` the royalty pool is collected from the sender by `SubFromBalance` tha
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
CVE-2026-55220
## Summary `Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource()` deserializes the `*__hot
Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
CVE-2026-55212
### Summary The Studio API class definition creation endpoint in `pimcore/studio-backend-bundle` is guarded by the `obje
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
CVE-2026-55208
## Summary An authenticated user extracts the admin password hash and any other database content through a time-based b
Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass
CVE-2026-55207
## Summary An unauthenticated attacker takes over any Pimcore admin account by sending a password reset request with an
Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。
Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。