CVE-2026-97673

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation...

CVE-2026-88962: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation...

PT-2026-107328

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description A path traversal issue allows a remote authenticated attacker to access and obtain sensitive information. Path traversal is a flaw that allows an attacker to access files and directori...

CVE-2026-97671: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability...

PT-2026-107480

Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files located outside the intended directory. Successfu...

CVE-2026-93678: Authorization Bypass Through User-Controlled Key

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization...

CVE-2026-107273: Server-Side Request Forgery (SSRF)

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service...

CVE-2026-104335: Improper Access Control

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control...

CVE-2026-106560: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected...

PT-2026-107542

Name of the Vulnerable Software and Affected Versions @backstage/plugin-scaffolder-backend-module-confluence-to-markdown versions prior to 0.3.25 Description Improper repository path validation in a scaffolder backend module allows an authenticated user who can execute an affected template and...

Microsoft Exchange Server Elevation of Privilege (October 2026)

The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by an elevation of privilege vulnerability. Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network. CVE-2026-96940 Not...

PT-2026-107753

Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions throug...

CVE-2026-19386: Stack-based Buffer Overflow

A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for...

CVE-2026-101331: Insufficiently Protected Credentials

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials...

CVE-2026-97717: Uncontrolled Resource Consumption

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service...

CVE-2026-76437: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of...

CVE-2026-105138: Insufficiently Protected Credentials

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

CVE-2026-5703: Path Traversal: '.../...//'

Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the UR...

CVE-2026-104651: Authorization Bypass Through User-Controlled Key

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to...

CVE-2026-97676: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code, resulting in a sandbox escape...