CVE-2026-17623

creationtimestamp| type| source ---|---|--- 2026-08-05 19:54:43+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msecmaqf5a23...

CVE-2026-66298 JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts

Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart. Livebook's JS-view feature renders notebook-defined JavaScript inside a sandboxed,...

Exploit for Eval Injection in Langflow

No d...

CVE-2026-10128

creationtimestamp| type| source ---|---|--- 2026-08-05 18:46:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/cvh7ufxaqy3uh...

CVE-2026-70448

creationtimestamp| type| source ---|---|--- 2026-08-05 18:34:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3uu2plyyoihiq...

CVE-2026-17632 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning...

CVE-2026-17632

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning...

EUVD-2026-53576

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning...

CVE-2026-70612

creationtimestamp| type| source ---|---|--- 2026-08-05 18:31:28+00:00| seen| https://gist.github.com/alon710/665009967811310873cc6bc149b1a673...

CVE-2026-48168

PraxionAI’s multi-agent PraisonAI system is affected by a command-injection in the bundled Claude GitHub Actions workflow prior to version 4.6.40. The vulnerability arises from an attacker-controllable pull request branch name injected into an unquoted Bash run block, combined with triggering by ...

CVE-2026-70447

Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-8446

creationtimestamp| type| source ---|---|--- 2026-08-05 18:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mse4aow6hz2l...

CVE-2026-70429

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in...

CVE-2026-17626

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...

CVE-2026-9190

creationtimestamp| type| source ---|---|--- 2026-08-05 17:16:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdzqmqsvx2l 2026-08-06 16:15:49+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-781...

CVE-2026-20267

creationtimestamp| type| source ---|---|--- 2026-08-05 17:07:01+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3msdzafb4i22n 2026-08-05 17:20:16+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdzxrqzrr2l 2026-08-06 05:17:05+00:00| seen|...

CVE-2026-20304

creationtimestamp| type| source ---|---|--- 2026-08-05 16:51:36+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3msdyet7jwc24 2026-08-05 17:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mse23e2oxs2p 2026-08-06 03:17:09+00:00| seen|...

CVE-2026-9077

Summary of CVE-2026-9077 (IBM Langflow OSS) : Langflow OSS versions 1.0.0–1.10.3 allow remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host. The vulnerability stems from weaknesses in MCP command/...

CVE-2026-70607 Electron: window.open features string controls some window options considered privileged

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open features string were applied to the new BrowserWindow without an allowlist...

CVE-2026-16442

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...