CISA Malcolm

RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and...

CVE-2026-106489

A flaw was found in the Backstage TechDocs backend plugin. An authenticated user with access to at least one documentation site can craft a request to bypass access controls when permissions and external storage are enabled. This flaw allows an attacker to view restricted documentation belonging ...

CVE-2026-106492

A flaw was found in @backstage/backend-defaults. The package fails to properly preserve access restrictions during service credential delegation when requests are routed through plugin delegation paths. An authenticated service with limited privileges can exploit this issue to bypass access...

EUVD-2026-94125

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem...

EUVD-2026-94128

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control...

CVE-2026-97680

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem...

CVE-2026-97680

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem...

CVE-2026-93445

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code...

CVE-2026-101329

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control...

CVE-2026-101329

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control...

EUVD-2026-94105

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control...

CVE-2026-104335

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control...

CVE-2026-104335

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control...

CVE-2026-93449 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation...

CVE-2026-93445 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code...

CVE-2026-93445

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to arbitrary code execution. A remote authenticated attacker can exploit the software due to improper control of generation of code (CWE-94). The vulnerability carries a CVSS 3.1 base score of 8.1 (High) , with impacts on confidentiali...

CVE-2026-76282: Improper Control of a Resource Through its Lifetime

Improper Control of a Resource Through its Lifetime. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration CWE, with one Common Vulnerabilities and Exposures...

PT-2026-107607

Name of the Vulnerable Software and Affected Versions Cisco networking software affected versions not specified Description Insufficient control flow management issues were identified during an internal security review. These issues are categorized under CWE-691, which refers to a failure to...

PT-2026-107617

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC affected versions not specified Description Insufficient access control to file system resources within the export policies functionality allows an authenticated remote attacker with...

PT-2026-107602

Name of the Vulnerable Software and Affected Versions Cisco Meraki affected versions not specified Description Improper access control issues were identified during an internal security review. These issues are categorized under CWE-284, which refers to improper access control, where a software...