AlmaLinux 10 : 389-ds-base (ALSA-2026:3208)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:3208 advisory. 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow CVE-2025-14905 Tenable has extracted the preceding description bloc...

LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution

Context A Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to langgraph-checkpoint 4.0.0, BaseCache defaults to JsonPlusSerializerpicklefallback=True. When...

baicai-base (0.1.2), baicai-tutor (0.1.0) potentially affected by CVE-2026-27794 via langgraph-checkpoint (2.0.25)

langgraph-checkpoint PYPI version 2.0.25 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - baicai-base 0.1.2 - baicai-tutor 0.1.0 Source cves: CVE-2026-27794 Source advisory: OSV:GHSA-MHR3-J7M5-C7C9...

EUVD-2026-8696

LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution...

@eui/deps-base (>=19.0.0-next.1, <=19.3.14), @eui/deps-base-light (>=19.0.0-next.1, <=19.3.14) +4 more potentially affected by CVE-2026-27739 via @angular-devkit/build-angular (>=19.0.0-next.10, <=19.2.19)

@angular-devkit/build-angular NPM version =19.0.0-next.10, =19.0.0-next.1, =19.0.0-next.1, =19.0.0, =19.0.1 - @ws-test-realm/admin-kit 0.5.0-ng19 - @ws-test-realm/devkit 0.7.0-ng19 - ng-deploy-oss 19.0.0 Source cves: CVE-2026-27739 Source advisory: SNYK:JS-ANGULARDEVKITBUILDANGULAR-15357315...

@eui/deps-base-light-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32), @eui/deps-base-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32) +1 more potentially affected by CVE-2026-27739 via @angular-devkit/build-angular (>=20.0.0-rc.0, <=20.1.0)

@angular-devkit/build-angular NPM version =20.0.0-rc.0, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - ng-deploy-oss 20.0.0 Source cves: CVE-2026-27739 Source advisory: SNYK:JS-ANGULARDEVKITBUILDANGULAR-15357315...

@eui/deps-base (>=21.0.0-alpha.10, <=23.0.0-alpha.1), @eui/deps-base-light (>=21.0.0-alpha.10, <=23.0.0-alpha.1) +1 more potentially affected by CVE-2026-27739 via @angular-devkit/build-angular (>=21.0.0-next.1, <=21.1.0)

@angular-devkit/build-angular NPM version =21.0.0-next.1, =21.0.0-alpha.10, =21.0.0-alpha.10, =23.0.0-alpha.1 - ng-deploy-oss 21.0.0 Source cves: CVE-2026-27739 Source advisory: SNYK:JS-ANGULARDEVKITBUILDANGULAR-15357315...

GHSA-X288-3778-4HHX Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline

A Server-Side Request Forgery SSRF vulnerability has been identified in the Angular SSR request handling pipeline. The vulnerability exists because Angular’s internal URL reconstruction logic directly trusts and consumes user-controlled HTTP headers specifically the Host and X-Forwarded- family t...

Cross-site Scripting (XSS)

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Cross-site Scripting XSS via the workflow creation and editing process in various nodes, including Form Trigger, Chat Trigger, Send & Wait, Webhook, and Chat nodes. An attacker can execute arbitrary...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere due to insufficient restrictions in the Python Code node sandbox. An attacker can access sensitive files or execute arbitra...

Eval Injection

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Eval Injection. An attacker can execute arbitrary code on the host system by submitting specially crafted form data that is interpreted as an expression. Note: This is only exploitable if a workflow...

CVE-2026-27794

A flaw was found in LangGraph Checkpoint. This vulnerability allows a remote attacker with write access to the cache backend to achieve remote code execution. This occurs when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. If msgpack...

CVE-2026-3192

A security vulnerability has been detected in Chia Blockchain 2.1.0. This issue affects the function authenticate of the file rpcserverbase.py of the component RPC Credential Handler. The manipulation leads to improper authentication. The attack is possible to be carried out remotely. The attack ...

CVE-2026-27794

LangGraph CVE-2026-27794 affects the Checkpoint component prior to version 4.0.0 where the BaseCache default serializer (JsonPlusSerializer with pickle_fallback) can deserialize attacker-supplied bytes from a cache backend if the application enables caching and nodes opt into CachePolicy. An atta...

CVE-2026-27794 LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution

LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to...

CVE-2026-27794 LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution

LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to...

RHSA-2026:3208 Red Hat Security Advisory: 389-ds-base security update

Bulletin has no description...

RHSA-2026:3189 Red Hat Security Advisory: 389-ds-base security update

Bulletin has no description...

Oracle Linux 10 : 389-ds-base (ELSA-2026-3208)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-3208 advisory. - Resolves: RHEL-137071 - CVE-2025-14905 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow rhel-10.1.z Tenable has extracted th...

PT-2026-21966

Name of the Vulnerable Software and Affected Versions Angular SSR versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21 Description Angular SSR, a server-side rendering tool for Angular applications, contains a Server-Side Request Forgery SSRF issue in its request handling pipeline. The...