CVE-2026-73484 Flowise before 3.1.3 Sandbox Escape via Pandas Methods

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like tocsv, tojson, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesyste...

CVE-2026-73483 Flowise before 3.1.3 Sandbox Escape via Puppeteer

Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to unfiltered CometD client-supplied headers being copied directly into the Camel Exchange, which allows an attacker to inject Camel control headers and manipulate downstream producers such as HTTP, file, or JMS...

python: Python Tarfile: Unexpected file ownership when extracting hardlinks

A flaw was found in the Python Tarfile.extract function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the filter parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leadin...

CVE-2026-19695

Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service...

CVE-2026-19694

TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service...

UBUNTU-CVE-2026-19694

TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service...

UBUNTU-CVE-2026-19696

Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...

FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A double-free vulnerability exists when a FreeRDP client processes a specially crafted .rdp connection file. An attacker could convince a victim to open a malicious .rdp file, leading to a size-controlled...

EUVD-2026-57745

TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service...

CVE-2026-19694

TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service...

EUVD-2026-57744

Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service...

CVE-2026-19695

Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service...

CVE-2026-19696 Out-of-bounds Write in Wireshark

Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows...

CVE-2026-19696

CVE-2026-19696 concerns an out-of-bounds write in Wireshark’s BLF file parser, affecting Wireshark versions 4.6.0 through 4.6.7 and potentially causing a denial-of-service on Windows. The vulnerability is triggered during parsing of BLF files (as used by Ixia IxVeriWave and Vector Informatik flow...

CVE-2026-19696

Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows...

CVE-2026-14298

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to properly limit resource consumption when processing certain user-supplied input, which allows an authenticated user to cause a denial of service. Mattermost Advisory ID: MMSA-2026-00713...

CVE-2026-14298 Denial of service via resource exhaustion in Mattermost

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to properly limit resource consumption when processing certain user-supplied input, which allows an authenticated user to cause a denial of service. Mattermost Advisory ID: MMSA-2026-00713...