68730 matches found
Security Bulletin: Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
Summary Langflow provides a visual interface for constructing and executing AI-powered agent workflows, exposing HTTP API endpoints for flow execution, file management, vector store operations, and Model Context Protocol MCP server configuration. An attacker could exploit insufficient validation...
Security Bulletin: Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
Summary Langflow provides a visual interface for constructing and executing AI-powered agent workflows, exposing HTTP API endpoints for flow execution, file management, vector store operations, and Model Context Protocol MCP server configuration. An attacker could exploit insufficient validation...
Security Bulletin: Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure
Summary The Python Interpreter component and legacy Python REPL Tool component provided flow and agent authors the ability to execute Python code within a scoped globals environment restricted to an operator-configured import allow-list and curated safe builtins. An attacker who could provide inp...
CVE-2026-52837 Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page
Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at /index.php/booking/reschedule/appointmenthash handled by Booking::index embeds the entire customer record as inline JavaScript const vars = ... "customerdata": ...,...
MAL-2026-10589 Malicious code in nodeaxois (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf1f3f7342689c11ad7e8c17a1c584fe3ce15615db82868b289d9613b48a41a The package declares scripts.postinstall: node.init.js, which runs automatically on npm install. The.init.js script collects host metadata os.hostnam...
MAL-2026-10588 Malicious code in momenntjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aae445dd0b77bd7409820067097404e4ccb16d658e7911c7c4e659146fdfad4 momenntjs is a typosquat of momentjs whose package.json postinstall hook runs node.init.js. On npm install,.init.js enumerates roughly 60...
Microsoft Office Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally...
Windows Cryptographic Services Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally...
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network...
Windows File Explorer Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally...
Win32k Elevation of Privilege Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an unauthorized attacker to elevate privileges locally...
Windows Kernel Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally...
Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally...
Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Trusted Runtime Interface Driver allows an authorized attacker to disclose information locally...
RabbitMQ Flaws Could Leak OAuth Secrets and Expose Cross-Tenant Queue Metadata
Cybersecurity researchers have disclosed details of two access control-related flaws impacting the RabbitMQ message broker service that could allow attackers to leak OAuth client secrets, expose enterprise messaging infrastructure to takeover risks, and bypass tenant boundaries. Miggo's security...
Information Exposure
Overview contao/core-bundle is an Open Source PHP Content Management System for people who want a professional website that is easy to maintain. Affected versions of this package are vulnerable to Information Exposure via the crawler that tries to prevent confidential HTTP client options from bei...
CVE-2026-49488
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OpenMeetings. This issue affects Apache OpenMeetings: from 5.0.0 before 9.1.0. An attacker with moderator rights in any room can read arbitrary files accessible to the OS account running the OM...
Security Bulletin: Multiple Vulnerabilities in IBM Engineering AI hub.
Summary Multiple vulnerabilities were addressed in IBM Engineering AI Hub version 1.3.0. Vulnerability Details CVEID:CVE-2026-41182 DESCRIPTION: LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the...
CVE-2026-15389
A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. The flaw lies in the fact that the system uses the session identifier USID as the sole validation mechanism, without verifying whether that...
CVE-2026-48978
A flaw was found in oras-go. The auth.Client in oras-go does not properly validate the scheme or host of the realm URL provided in a registry's WWW-Authenticate: Bearer challenge. A remote attacker, operating a malicious registry or performing a man-in-the-middle attack, could exploit this to...