68479 matches found
CVE-2026-8505 Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution
IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False which is the default...
CVE-2026-8505
CVE-2026-8505 affects Langflow OSS 1.0.0–1.10.0. A flaw in the webhook authentication logic bypasses API key validation when WEBHOOK_AUTH_ENABLE is False (default), allowing unauthenticated remote execution of any flow and potentially RCE/DoS. IBM’s bulletin confirms the vulnerability and that th...
Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration
Formie contains a missing authorization vulnerability in administrative settings routes. An authenticated, non-admin Craft CMS control panel user with limited Formie access could directly access Formie settings pages and modify global plugin configuration. In affected versions, Formie...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the administrative settings routes due to missing authorization checks. An attacker can modify global plugin configuration and access restricted settings by directly accessing specific control panel routes with ...
CVE-2026-57860
ForgeCode tailcallhq/forgecode, an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and...
CVE-2026-16104
A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...
CVE-2026-16104
A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...
CVE-2026-16104
CVE-2026-16104 affects the authentication configuration endpoint in the Keycloak services used by Red Hat Build of Keycloak. The underlying issue is that the system does not mask sensitive configuration values (e.g., reCAPTCHA secrets) when requested by administrators with view-only permissions, ...
CVE-2026-16104
A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...
CVE-2026-57860
ForgeCode tailcallhq/forgecode, an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and...
EUVD-2026-45217
ForgeCode tailcallhq/forgecode, an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and...
CVE-2026-57860 ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository
ForgeCode tailcallhq/forgecode, an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and...
CVE-2026-60024
The Events Booking Joomla extension (by joomdonation.com) versions prior to 5.8.0 is affected by an insecure default configuration . This vulnerability allows unauthenticated users to upload media assets to the server by default. Exploitation details are not provided in the documents, but the vul...
CVE-2026-15007
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to cause service disruption by supplying a repository release notes configuration file containing deeply nested YAML. When release notes were generated, the configuration file was parse...
Security update for tomcat10
This update for tomcat10 fixes the following issues Update to Tomcat 10.1.56. Security issues fixed: CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example bsc1269791. CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused...
SUSE-SU-2026:3112-1 Security update for tomcat10
This update for tomcat10 fixes the following issues Update to Tomcat 10.1.56. Security issues fixed: - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example bsc1269791. - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve...
WinRM Config Audit
Audit local WinRM service configuration, listeners, authentication, and TrustedHosts !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePost: info = "name": "WinRM Config Audit", "description": "Audit local WinRM service configuration, listeners, authentication, and...
minder v0.2.0
| | | | | Installation | Documentation | Releases What is Minder? Minder is an open source platform that helps development teams and open source communities build more secure software, and prove to others that what they’ve built is secure. Minder helps project owners proactively manage their...
Missing Authorization
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization in the message actions. An attacker can perform unauthorized actions by sending requests as a lower-trust user or through a configured input path when the feature is...