CVE-2026-97671

IBM Langflow OSS versions 1.0.0 through 1.12.2 are susceptible to a path traversal vulnerability (CWE-22 ). This flaw could allow a remote authenticated attacker to obtain sensitive information . No specific exploit details, impacts beyond information disclosure, or remediation steps are provided...

CVE-2026-97717: Uncontrolled Resource Consumption

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service...

CVE-2026-93678: Authorization Bypass Through User-Controlled Key

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization...

CVE-2026-101331: Insufficiently Protected Credentials

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials...

Linux Distros Unpatched Vulnerability : CVE-2026-102580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary...

EUVD-2026-89719

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected...

CVE-2026-102580 Moodle: arbitrary class instantiation via report builder audience classname

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected...

DEBIAN-CVE-2026-92869

An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination...

AlmaLinux 9.2 [TuxCare] Security Update: cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-doc-extra / etc (ALMALINUX9.2:CLSA-2026:1779119949)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779119949 advisory. - Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many...

CVE-2026-84414 IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...

EUVD-2026-89202

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...

CVE-2026-91085

A vulnerability exists in Apache Karaf where the shell/SSH command security system fails open when no specific Access Control List (ACL) rule matches a command. Specifically, the org.apache.karaf.command.acl.config ACL lacks an entry for config:install, allowing any authenticated user—including t...

CVE-2026-91085 Apache Karaf: config:install missing ACL entry allows privilege escalation to admin

Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files etc/org.apache.karaf.command.acl..cfg. SecuredSessionFactoryImpl.checkSecurity resolves the roles required for an invocation and, when no ACL rule matches the command, fails...

CVE-2026-102373 GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks...

CVE-2026-54708

FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or writ...

CVE-2026-54675 FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module

FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution RCE. Authentication...

Security Bulletin: IBM DataPower Gateway affected by server-side request forgery (CVE-2026-14521)

Summary IBM DataPower Gateway affected by server-side request forgery CVE-2026-14521 Vulnerability Details CVEID:CVE-2026-14521 DESCRIPTION: IBM DataPower Gateway is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the...

EUVD-2026-88201

Stored Cross-Site Scripting XSS in TPVEnlanube affecting the following endpoint and parameter: CVE-2026-7171: parameter 'Apellido 1' in the endpoint '/administrator/index.php?page=admin.useradd&userid=45&option=comvirtuemart'. Successful exploitation of this vulnerability could allow an...

CVE-2026-82377

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...

EUVD-2026-87946

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation...