CVE-2026-69111 Milvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint,...

CVE-2026-9130

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...

MGASA-2026-0323 Updated tomcat packages fix security vulnerabilities

The updated packages fix security vulnerabilities: XSS in number guess example. CVE-2026-50229 Bad ornext processing in RewriteValve. CVE-2026-53404 Invalid CRL configuration doesn't trigger failure for FFM Connector. CVE-2026-53434 Logged effective web.xml is incomplete. CVE-2026-55276...

Updated tomcat packages fix security vulnerabilities

The updated packages fix security vulnerabilities: XSS in number guess example. CVE-2026-50229 Bad ornext processing in RewriteValve. CVE-2026-53404 Invalid CRL configuration doesn't trigger failure for FFM Connector. CVE-2026-53434 Logged effective web.xml is incomplete. CVE-2026-55276...

CVE-2026-8446

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol MCP composer endpoint when mcpcomposerenabled=true default and projects are configured with authtype=oauth...

CVE-2026-8446

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol MCP composer endpoint when mcpcomposerenabled=true default and projects are configured with authtype=oauth...

CVE-2026-8446

Langflow OSS versions 1.0.0–1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects use auth_type=oauth. The issue, tracked under CVE-2026-8446, enables bypassing authentication for the MCP c...

CVE-2026-8446

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol MCP composer endpoint when mcpcomposerenabled=true default and projects are configured with authtype=oauth...

EUVD-2026-53465

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol MCP composer endpoint when mcpcomposerenabled=true default and projects are configured with authtype=oauth...

CVE-2026-9192

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators...

CVE-2026-9190

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

CVE-2026-16442

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...

Authentication Bypass by Primary Weakness

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the ProtocolResponse.url when a custom protocol handler omits the session...

Authentication Bypass by Primary Weakness

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the ProtocolResponse.url when a custom protocol handler omits...

CVE-2026-9192 Authentication bypass in Progress MarkLogic Server ODBC App Server

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators...

CVE-2026-9192

Summary (CVE-2026-9192) : A authentication-bypass vulnerability exists in the ODBC App Server component of Progress MarkLogic Server, affecting versions before 11.3.6 and 12.0.3. An unauthenticated remote attacker can bypass password verification and run queries with the privileges of any named u...

EUVD-2026-53427

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators...

EUVD-2026-53426

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

CVE-2026-9190 HTTP request smuggling in Progress MarkLogic Server

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

CVE-2026-9190

Progress MarkLogic Server versions before 11.3.6 and 12.0.3 contain an HTTP request smuggling flaw in the HTTP App Server. A crafted request with both Content-Length and Transfer-Encoding headers can cause the reverse proxy and MarkLogic Server to misinterpret request boundaries, enabling an atta...