CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-100778

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Core & HTML component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2026-100805

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Race condition, use-after-free in the Audio/Video component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Securi...

CVE-2026-100804

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Preferences: Backend component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2026-100768

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: WebGPU component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

CVE-2026-37719

An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Security. The supported versions affected by this vulnerability are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Serialization. The supported versions affected by this vulnerability are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Network component of Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: net/mlx5e: Fixed a use-after-free in the encap entry handling during neigh update processing. The function mlx5erepneighupdate was updated to properly handle the removal of the rtnl lock from the TC filter update path, as well...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in the Settings component of Google Chrome prior to version 95.0.4638.54 allowed a remote attacker to interact with Dev Tools, potentially exploiting heap corruption through a crafted HTML page...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ixgbe: fixed the refcount leak for PCI devices As stated in the comment for pcigetdomainbusandslot, it returns a PCI device with the reference count incremented. When using this device, the caller must decrement the reference...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux 5.15

A NULL pointer dereference vulnerability was discovered in the vmwgfx driver, located in the file vmwgfxexecbuf.c within the GPU component of the Linux kernel. The vulnerability affects device files such as '/dev/dri/renderD128' or 'Dxxx'. This flaw allows a local attacker with a user account on...

Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite uses httpclient5-5.6.3.jar and is vulnerable to CVE-2026-71290

Summary IBM Maximo Manage application in IBM Maximo Application Suite uses httpclient5-5.6.3.jar and is vulnerable to CVE-2026-71290. This bulletin contains information regarding how to address these vulnerabilities. Vulnerability Details CVEID:CVE-2026-71290 DESCRIPTION: Improper TLS hostname...

CVE-2026-37719

An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...

CVE-2026-37719

An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...

CVE-2026-37719

The dormakaba evolo Service (all versions) is vulnerable to a remote code execution (RCE) flaw. A remote attacker can exploit a .NET component to execute arbitrary code with SYSTEM privileges. The vulnerability is associated with CWE-502 (Deserialization of Untrusted Data). No specific exploitati...

EUVD-2026-92471

An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...

PT-2026-106001

An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...

CVE-2026-37719: Deserialization of Untrusted Data

An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...