CVE-2026-33017-langflow-rce

CVE-2026-33017 — Esecuzione remota di codice RCE non autenticata in Langflow Panoramica ID CVE: CVE-2026-33017 Software interessato: Langflow Versioni vulnerabili: = 1.9.0 Gravità: Critica Autore: r3nsi15 Data: 2026 Descrizione Langflow espone un endpoint pubblico di build dei flow...

CVE-2026-9198

CVE-2026-9198 - IBM Langflow RCE sem autenticação via bypass de auto-login PoC educacional Este repositório fornece uma prova de conceito educacional para CVE-2026-9198 que afeta o IBM Langflow OSS. O PoC poc.py demonstra como um atacante não autenticado pode encadear: 1. GET/POST /api/v1/autolog...

CVE-2025-13390

WP Directory Kit = 1.4.4 - Bypass de Autenticação para Escalação de Privilégios via Account Takeover Resumo O plugin WP Directory Kit para Wordpress versão 1.4.4 e anteriores contém um bypass de autenticação na sua funcionalidade de auto-login. A vulnerabilidade permite que atacantes não...

Shadow-Vault

Shadow Vault 🔐 Shadow Vault هي أداة ويب خفيفة مبنية بلغة PHP مصممة لـ مدراء الأنظمة لإضافة بيانات اعتماد مستخدمين جدد بشكل آمن إلى ملفات shadow في بيئات الاستضافة المشتركة. تكتشف تلقائيًا تنسيق تقادم shadow الموجود، وتستخدم تجزئة كلمات المرور SHA-512، وتدعم طرق كتابة احتياطية متعددة، بل وتوفر تسج...

CVE-2026-9198

🚨 CVE-2026-9198 IBM Langflow OSS RCE non autenticata tramite bypass del login automatico 📋 Panoramica CVE-2026-9198 è una vulnerabilità critica di Remote Code Execution RCE non autenticata in IBM Langflow OSS. Questo exploit combina due vulnerabilità: CVE-2026-9103 : Bypass del login automatico c...

CVE-2026-18052 ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

CVE-2026-18052

CVE-2026-18052 affects the ManageWP Worker WordPress plugin in versions prior to 4.9.37 . The plugin's auto-login mechanism fails to bind the target account to the cryptographic signature that authorises the login, and does not prevent replay of an already-used login link. An attacker who obtains...

CVE-2026-64961

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

CVE-2026-64961

ATutor (a learning management system) is vulnerable to authentication bypass in its auto-login functionality. Although a token validation check exists, the values required for token validation remain uninitialized in certain code paths , allowing an unauthenticated attacker who knows a user's ide...

EUVD-2026-63361

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

CVE-2025-13390

CVE-2025-13390 WP Directory Kit Il plugin WP Directory Kit per WordPress è vulnerabile al bypass dell'autenticazione in tutte le versioni fino alla 1.4.4 inclusa, a causa di un'implementazione errata dell'algoritmo di autenticazione nella funzionewdkgenerateautologinlink. Ciò è dovuto al fatto ch...

CVE-2026-47234 Admidio writes session IDs and auto-login cookie values to application logs

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...

CVE-2026-47234

CVE-2026-47234 affects Admidio before 5.0.10. When debug logging is enabled, Admidio logs raw cookie values and the active session ID via Session::setCookie() and Session::start(), exposing live session tokens (including auto-login cookies) in application logs. This creates a local/credential-sto...

CVE-2026-47234 Admidio writes session IDs and auto-login cookie values to application logs

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...

CVE-2026-47363

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

CVE-2026-47363

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

CVE-2026-47363

The CVE-2026-47363 describes a vulnerability in the Datadog Android app where the launcher activity AppActivity is exported with no permission guard and launchMode=singleTask. On every onCreate/onNewIntent, an extension (Intent.getUserSession()) deserializes a full UserSession (including user ide...

CVE-2026-9130

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...

CVE-2026-9130

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...

CVE-2026-9130 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...