1325866 matches found
CVE-2026-42694
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0...
CVE-2026-119145
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achiev...
CVE-2026-18894
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are...
CVE-2026-119138
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons the Store. Attackers supplying misbehaving guest code can cause a trap and let earlier calls proceed, crashing embedders...
CVE-2026-118079
Shop manager PHP Object Injection in FV Flowplayer Video Player = 8.3.4 versions...
CVE-2026-116864
Author PHP Object Injection in WPCargo Track & Trace = 8.0.5 versions...
CVE-2026-116865
Editor PHP Object Injection in Zippy = 1.7.0 versions...
CVE-2026-116867
Contributor PHP Object Injection in Dynamic QR Code generator = 1.0.1 versions...
CVE-2026-111732
P-Net before 1.0.3, when built with PNETOPTIONARVENDORBLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block...
CVE-2026-110309
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation...
CVE-2026-111730
P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in getcheckpeer. The received length up to 255 was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end o...
CVE-2026-110196
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs...
CVE-2026-110186
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation...
CVE-2026-107328
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec...
CVE-2026-107327
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization...
CVE-2026-107326
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
CVE-2026-107329
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation...
CVE-2026-104324
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data...