CVE-2026-9458

creationtimestamp| type| source ---|---|--- 2026-06-22 04:17:05+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3motzp5h7px2b...

CVE-2026-9457

creationtimestamp| type| source ---|---|--- 2026-06-22 04:16:43+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3motzoies3n2r...

CVE-2026-9387

creationtimestamp| type| source ---|---|--- 2026-06-22 02:47:03+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3motuo2fcjb2n...

Arbitrary Code Injection

Overview langflow is an A Python package with a built-in web application Affected versions of this package are vulnerable to Arbitrary Code Injection in the Bundle URL Loader process. An attacker can execute arbitrary code by supplying crafted input to this component. Remediation Upgrade langflow...

EUVD-2026-38203

A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads to code injection. The attack needs to be performed locally. The vendor was contacted early about this disclosure but did not respond in...

EUVD-2026-38199

A vulnerability was detected in activepieces up to 0.83.0. This vulnerability affects the function handleUrlFile in the library packages/server/engine/src/lib/variables/processors/file.ts of the component File URL Handler. The manipulation results in server-side request forgery. The attack can be...

EUVD-2026-38197

A weakness has been identified in kortix-ai suna up to 0.8.38. Affected by this issue is the function router.replace/router.push of the file apps/frontend/src/app/auth/page.tsx of the component Auth Endpoint. Executing a manipulation of the argument returnURL can lead to cross site scripting. The...

CVE-2026-7876

creationtimestamp| type| source ---|---|--- 2026-06-22 00:26:03+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3motmrhl6fn2f...

PT-2026-55193

Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation. Unauthenticated attackers can bypass the internal-address blocklist using IPv6-mapped IPv4 addresses to reac...

CVE-2026-12822: Improper Control of Generation of Code

A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads to code injection. The attack needs to be performed locally. The vendor was contacted early about this disclosure but did not respond in...

CVE-2026-12863: URL Redirection to Untrusted Site

An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains...

CVE-2026-56697: URL Redirection to Untrusted Site

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-protocol check but resolve to a cross-origin URL against the current page protocol. Attackers can inject paths like //evil.com to redirect...

Tenda F453 httpd fromSafeUrlFilter Code Execution

The vulnerability of the fromSafeUrlFilter function /goform/SafeUrlFilter in the Tenda F453 router microprogramming software is caused by buffer overflow. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code or cause service failures remotely...

Linux Distros Unpatched Vulnerability : CVE-2026-54282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because...

Linux Distros Unpatched Vulnerability : CVE-2026-12804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in lemonldap-ng up to 2.23.0. Impacted is an unknown function in the library lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm of...

PT-2026-51317

The vulnerability is present in the ‘/addJugador’ endpoint: The 'keyJugador' and 'keyJugadorObjectiu' parameters allow the modification of other users’ information without requiring prior authorization validation. This could enable an authenticated attacker to alter any user’s ID and change their...

PT-2026-56389

NLTK Natural Language Toolkit is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments...

CVE-2026-54293: Improper Limitation of a Pathname to a Restricted Directory

NLTK Natural Language Toolkit is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments...

CVE-2026-12822

A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads to code injection. The attack needs to be performed locally. The vendor was contacted early about this disclosure but did not respond in...

CVE-2026-12822 langflow-ai langflow Bundle URL Loader code injection

A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads to code injection. The attack needs to be performed locally. The vendor was contacted early about this disclosure but did not respond in...