EUVD-2026-51275

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an...

CVE-2026-13444

Langflow OSS (IBM Langflow Langflow OSS) 1.0.0–1.10.1 is affected by CVE-2026-13444, allowing an attacker to access another user’s private vector documents by creating a flow with matching Chroma persist_directory and collection_name values. The attacker can see exact victim content in their work...

CVE-2026-66066

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

CVE-2026-15978 CVE-2026-15978

SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights...

CVE-2026-15977 CVE-2026-15977

SGLang contains a credential leakage vulnerability in the /serverinfo endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured...

CVE-2026-15977

SGLang contains a credential leakage vulnerability tracked as CVE-2026-15977 affecting the /server_info endpoint. When only the --admin-api-key is configured, the endpoint may disclose API keys and SSL keyfile information. Impact is exposure of sensitive credentials, with CVSS 3.1 details indicat...

CVE-2026-15974

SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...

EUVD-2026-51263

SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...

CVE-2026-15974 CVE-2026-15974

SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...

CVE-2026-15974

SGLang (CVE-2026-15974) has a documented SSRF and local file-read flaw in the multimodal generation endpoint /v1/chat/completions caused by unsanitized image_url, enabling access to internal metadata, secrets, and services. The connected sources confirm the vulnerability details but do not provid...

CVE-2026-15974 CVE-2026-15974

SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...

EUVD-2025-210545

IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-36374 IBM DataPower Gateway affected by XML external entity injection

IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-36374 IBM DataPower Gateway affected by XML external entity injection

IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-36374

IBM DataPower Gateway is affected by CVE-2025-36374 due to an XML External Entity (XXE) vulnerability (CWE-611). The issue occurs when processing XML data and could allow a privileged user to expose sensitive information or exhaust memory. Affected products/versions include DataPower Gateway 10.6...

CVE-2026-48499 Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache

Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowin...

CVE-2026-48499

Activepieces contains a cross-tenant data exposure and code injection vulnerability (CVE-2026-48499) due to an unsanitized path segment in the Code piece sandbox. Before version 0.84.0, an authenticated flow author could reach read-write cached flow and code files belonging to other tenants on th...

SUSE CVE-2026-17827

Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-41328

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack require...

CVE-2026-10700

IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user files.The /api/v1/files/images/flowid/filename endpoint does not enforce authentication or authorization checks, allowing unauthenticated...