Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint

Summary Langflow is vulnerable to Path Traversal in the Knowledge Bases API POST /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the createknowledgebase function. An attacker can create or overwrite arbitrary files and directories on the server's filesystem by supplying specially crafted input in the name field. Details A Directory Travers...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-33760 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-33760 Source advisory: SNYK:PYTHON-LANGFLOWBASE-17400135...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the monitor API endpoints, which lack proper ownership enforcement. An attacker can read, modify, rename, or permanently delete another user's messages, sessions, build artifacts, and...

Important: Red Hat Security Advisory: New container image: rhceph-9.0

A new version of Red Hat build of Ceph Storage has been released The Red Hat Storage Ceph container images are based on the latest ubi9 base image and Ceph 9.0. This release updates to the latest version...

CVE-2026-10649

Pacemaker vulnerability CVE-2026-10649: an unauthenticated remote attacker can trigger an integer overflow in the remote message decompression, causing memory corruption and denial of service in the CIB remote listener. Affects Pacemaker (remote message processing) with network attack vector, no ...

gen-ui-kit (0.1.1), jpl-rosa (1.0.7) +2 more potentially affected by CVE-2026-55443 via langchain (0.3.2)

langchain PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - gen-ui-kit 0.1.1 - jpl-rosa 1.0.7 - myscalekb-agent-base =0.0.1, =0.1.6 - originhub-myscalekb-agent-base 0.1.8 Source cves: CVE-2026-55443...

baicai-base (0.1.2), baicai-tutor (0.1.0) +7 more potentially affected by CVE-2026-55443 via langchain (0.3.24)

langchain PYPI version 0.3.24 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - baicai-base 0.1.2 - baicai-tutor 0.1.0 - cneura-ai =0.1.1, =0.1.12, =0.4.7, =0.1.13, =0.1.0, =1.4.10 - ragbuilder 0.1.6 - spart-prompt 1.0.0...

knowledge-base-guardian (0.0.1) potentially affected by CVE-2026-55443 via langchain (0.0.213)

langchain PYPI version 0.0.213 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - knowledge-base-guardian 0.0.1 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

Important: Red Hat Security Advisory: Red Hat Update Infrastructure 5.2 security update

The latest release of Red Hat Update Infrastructure. For more details, see the product documentation. Red Hat Update Infrastructure RHUI container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images. This release updates to the latest version...

postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind

A flaw was found in PostgreSQL. This vulnerability, related to symlink following in pgbasebackup plain format and pgrewind, allows an origin superuser to overwrite local files. By exploiting this, an attacker could potentially hijack the operating system account. This attack has practical...

PT-2026-49973

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 13.5 Oracle Enterprise Manager Base Platform version 24.1 Description An issue exists in the Extensibility Framework component of the Oracle Enterprise Manager Base Platform. A high privileged...

PT-2026-53031

Summary The Docker API server let a request control where LLM calls were sent and which environment variable an LLM token resolved from. Both could be abused to exfiltrate server-held secrets. The Docker API is unauthenticated by default. Vector 1 - attacker base url /md, /llm, and /llm/job...

PT-2026-50141

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.0 Description Langflow contains a path traversal flaw in the Knowledge Bases API endpoint 'POST /api/v1/knowledge bases'. The issue resides in the create knowledge base function, where the name variable is used t...

PT-2026-49965

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 13.5 Oracle Enterprise Manager Base Platform version 24.1 Description An issue exists in the Oracle Management Service component of the Oracle Enterprise Manager Base Platform. This flaw allows a...

PT-2026-49962

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 13.5 Oracle Enterprise Manager Base Platform version 24.1 Description An issue exists in the Target Management component of the Oracle Enterprise Manager Base Platform. A low privileged attacker...

PT-2026-49723

Name of the Vulnerable Software and Affected Versions Pacemaker affected versions not specified Description An integer overflow exists in the remote message decompression process. An unauthenticated remote attacker can exploit this by sending a specially crafted compressed remote message before...

PT-2026-49980

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Install. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle...

PT-2026-49983

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 13.5 Oracle Enterprise Manager Base Platform version 24.1 Description An issue exists in the Deployment Library component of the Oracle Enterprise Manager Base Platform. A high privileged attacke...

PT-2026-49975

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 13.5 Oracle Enterprise Manager Base Platform version 24.1 Description An issue exists in the Extensibility Framework component of the Oracle Enterprise Manager Base Platform. A high privileged...