PT-2026-89610

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description A logic error in the static security scanner allows an attacker to bypass security checks by crafting an annotated class-body assignment. This technique uses alias tracking to resolve ...

...[ More ]

This Metasploit module exploits CVE-2026-20079, an authentication bypass in the web interface of Cisco Secure Firewall Management Center FMC. It upgrades a boot-created machine session, obtains its session-specific action token, writes a Makeself-compatible shell script, and executes the selected...

GHSA-HXJG-93WC-H8P8 Komari: Management Interface CSRF

Vulnerability Overview The sessiontoken cookie is set without the SameSite or Secure attributes login.go:68. All /api/admin/ management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation. The server-side vulnerability is confirmed to exist; however,...

Komari: Management Interface CSRF

Vulnerability Overview The sessiontoken cookie is set without the SameSite or Secure attributes login.go:68. All /api/admin/ management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation. The server-side vulnerability is confirmed to exist; however,...

CVE-2026-73769

A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-73787

A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-73787

HPE CPPM (Campus Policy Manager) contains a vulnerability in its web interface that allows an authenticated remote attacker to access directory information on the system, which can escalate to arbitrary command execution on the underlying operating system via an arbitrary file write mechanism (as...

EUVD-2026-75124

A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-73769

CVE-2026-73769 affects the web-based management interface of HPE CPPM systems. An authenticated remote attacker with high-level privileges can achieve remote code execution , allowing arbitrary command execution on the underlying operating system. The CVSS 3.1 score is 7.2 (HIGH) with a vector of...

EUVD-2026-75122

A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-73769 Authenticated Remote Code Execution in CPPM Web Interface

A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

RLSA-2026:65606 Important: gpsd-minimal security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. The Rocky Enterprise Software Foundation support fo...

gpsd-minimal security update

An update is available for gpsd-minimal. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list gpsd is a service daemon that mediates access to a GPS sensor connected ...

CVE-2026-19233

CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint...

GHSA-7RHF-42QF-VRVC gix-sec safe.directory protections absent for elevated administrators

Summary In a process run with full administrative rights on Windows, gix-sec wrongly treats all locations as trusted, leading to the execution of commands configured in repositories controlled by limited user accounts. Details In a similar way to Git, gitoxide tries to avoid operating in local...

CVE-2026-19233

CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint...

CVE-2026-19233

CVE-2026-19233 is a Server-Side Request Forgery (SSRF, CWE-918) vulnerability affecting a Schneider Electric product (identified by CNA [email protected] and advisory SEVD-2026-251-01 ). An attacker with a privileged account can send crafted, unvalidated parameters to a server endpoint, potent...

EUVD-2026-75105

CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint...

CVE-2026-79945

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit...

CVE-2026-78484

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit...