PYSEC-2026-4238 Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Summary Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path: - POST /api/v1/build/flowid/vertices retrieveverticesorder - POST /api/v1/build/flowid/vertices/vertexid buildvertex Any...

PYSEC-2026-4234 Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Summary Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path: - POST /api/v1/build/flowid/vertices retrieveverticesorder - POST /api/v1/build/flowid/vertices/vertexid buildvertex Any...

Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

SummaryBefore Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path:- POST /api/v1/build/flowid/vertices retrieveverticesorder- POST /api/v1/build/flowid/vertices/vertexid buildvertexAny...

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

SummaryThe Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious...

PYSEC-2026-4220 Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Summary The Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious...

CVE-2026-102944

A flaw was found in cpp-httplib. When following cross-origin HTTP redirects, the client fails to remove Cookie headers before sending the request to the new target. A remote attacker controlling a redirect server or observing unencrypted traffic can exploit this flaw to capture session cookies...

idm:DL1 security, bug fix, and enhancement update

An update is available for opendnssec, module.opendnssec, bind-dyndb-ldap, module.python-jwcrypto, module.python-kdcproxy, python-qrcode, module.python-qrcode, ipa, ipa-healthcheck, softhsm, module.python-yubico, module.ipa, module.slapi-nis, module.custodia, pyusb, python-jwcrypto,...

Critical: Red Hat Security Advisory: idm:DL1 security, bug fix, and enhancement update

An update for the idm:DL1 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability...

Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting

Microsoft Exchange Server is vulnerable to a spoofing vulnerability. Be aware this CVE ID is unique from CVE-2021-42305. id: CVE-2021-41349 info: name: Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting author: rootxharsh,iamnoooob severity: medium description: Microsoft Exchange...

OpenEMR < 7.0.1 - Cross-Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.1. id: CVE-2023-2948 info: name: OpenEMR 7.0.1 - Cross-Site Scripting author: ritikchaddha,princechaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr...

Important: Red Hat Security Advisory: Red Hat build of MicroShift 4.18.57 security update

Red Hat build of MicroShift release 4.18.57 is now available with updates to packages and images that include a security update. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-102944

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, createredirectclient removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect copies the request for those...

EUVD-2026-102257

XXL-JOB =3.5.0-SNAPSHOT contains a stored Cross-Site Scripting XSS vulnerability in the job log list page /joblog. An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST...

PT-2026-115095

Name of the Vulnerable Software and Affected Versions ELADMIN versions prior to 2.7 Description Cross Site Scripting XSS occurs via the WebSocketServer component, SpringSecurityConfig, and deploy.vue. XSS is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other...

CVE-2026-110141

Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

PT-2026-115119

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handle...

CVE-2026-111232: Improper Neutralization of Input During Web Page Generation

Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator color value that...

PT-2026-114988

🚨 CVE-2026-111092 In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands 🎖@cveNotify...

CVE-2026-106706

XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting XSS in the GLUE code editor. JobCodeController.save stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped...