IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute...
CVE-2026-18729
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to impro
#severity:high
共收录 5383 条相关情报。
← 返回所有主题IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows...
CVE-2026-18891
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive info
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due...
CVE-2026-18899
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and...
CVE-2026-80198
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allo
RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation...
CVE-2026-73108
RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before
Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry...
CVE-2026-80193
Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new t
StarRocks performs no privilege check when a legacy synchronous materialized view is dropped....
CVE-2026-80346
StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type
RestrictedPython guard hooks can be shadowed via positional-only arguments
CVE-2026-55830
### Impact RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes `_getattr
Snipe-IT has an Improper Privilege Management issue
CVE-2026-55843
## Impact The `update()` method in `UsersController` passes the `permission` request field unconditionally to `Normaliz
MapFish Print has XXE that allows reading arbitrary files of certain types
CVE-2026-55848
### Summary XXE on MapFish Print allows reading arbitrary files of certain types. Eg /etc/passwd or k8 secrets and certs
free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI
CVE-2026-55784
### Summary The AUSF component of free5GC stores per-subscriber authentication state in a global `sync.Map` keyed only
SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
CVE-2026-55874
### Summary The SeaweedFS S3 API gateway did not reject `..` path segments in the `X-Amz-Copy-Source` header used by `Co
Fortigate syslog message parser can be exploited to modify or delete fields from the original message
CVE-2026-55841
### Impact A security issue has been identified in Graylog affecting the parsing of syslog messages that use a key-valu
klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply
CVE-2026-55764
## Summary On the SFT add-quantity path the only supply bound is `SFTAddCirculation`, which does `meta.Circulation += am
Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any...
CVE-2026-82289
Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab.,
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing...
CVE-2026-82291
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cros
Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history...
CVE-2026-82284
Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api...
CVE-2026-82285
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/call
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to...
CVE-2026-82287
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions b
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers,...
CVE-2026-82283
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users t