CVE-2026-70611 Electron: DevTools embedder handler executes arbitrary files via shell open

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running...

MAL-2026-13372 Malicious code in eth-account-wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc3337915e7c14a0ceb6743d1edf2e607fd7926656b49cdd041d7b161b718178 eth-account-wallet 0.11.2 is a typosquat of the eth-account PyPI package. Its setup.py installs a custom install cmdclass PI that, on pip install,...

CVE-2026-71281

A flaw was found in peft. The LoRA-GA and CorDA initialization modules within Hugging Face peft improperly call torch.load without the weightsonly=True parameter. This oversight allows for full pickle deserialization when loading a malicious cache or covariance file. A remote attacker could explo...

CVE-2026-9077

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system...

CVE-2026-7646

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP resources/read request with a URL-encoded path...

CVE-2026-17626

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...

CVE-2026-17626

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...

EUVD-2026-53473

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...

CVE-2026-17626 Langflow is affected by security vulnerabilities in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...

CVE-2026-17626

CVE-2026-17626 affects IBM Langflow OSS versions 1.0.0–1.10.3. An authenticated attacker could read, modify, or expose sensitive host files through Docker-based MCP servers due to incomplete filtering of dangerous docker volume-mount and device-mapping arguments. The IBM/NVD entries describe the ...

CVE-2026-7646

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP resources/read request with a URL-encoded path...

EUVD-2026-53464

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP resources/read request with a URL-encoded path...

CVE-2026-9077

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system...

CVE-2026-70605

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redire...

CVE-2026-70605 Electron: HTTP redirect followed into local file loader

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redire...

EUVD-2026-53442

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redire...

Electron: HTTP redirect followed into local file loader

Impact When following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affecte...

CVE-2026-12762

CVE-2026-12762 affects IBM Cloud Pak for Business Automation versions 24.0.0, 24.0.1, 25.0.0, and 26.0.0. The issue could allow a remote attacker to obtain sensitive information exposed in manifest files. The available documents do not specify the exact root cause, vulnerable component, or exploi...

Malicious code in dlab_workshop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 452b525d6d3fc409e081d5f8a6f052c7b3b9899d1f088a24d93e4be4de65c9cf The package's index.js reads installer-owned secret files from the home directory /.ssh/idrsa, /.ssh/ided25519, /.ssh/config, /.aws/credentials,...

Malicious code in bigops-storio-store-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b6c9395cd17d3e76a94ed855d2d585fdb597785eac2cfefe873f79fc2b98d58 On require of the package, index.js loads bridge.js which selects a platform-specific binary path and downloads an opaque native binary from...