CVE-2026-18904 Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers...

CVE-2026-18899

IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to a path traversal (CWE-22) that allows an unauthenticated remote attacker to read arbitrary files. The root cause is in the public flow-build endpoint, which accepts an unvalidated files parameter forwarded directly to the storage backend; the...

ResetNightmare

ResetNightmare Strumento proof-of-concept POC per ResetNightmare CVE-2026-27912. ResetNightmare è una falla di validazione nel protocollo Kerberos Change Password che consente di reimpostare la password di qualsiasi account utente/computer, senza conoscerne quella attuale. L'attacco richiede un...

EUVD-2026-42984

Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update...

cve-2025-53770-research

cve-2025-53770-research 🚨 Ricerca sul threat intelligence e sulla risposta agli incidenti relativa al zero-day RCE "ToolShell" di SharePoint CVE-2025-53770. 🕵️‍♂️ Copre le vulnerabilità di deserializzazione alla radice, le tempistiche di attacco, le metriche di rischio e i playbook difensivi/EDR di...

CVE-2026-57827

CVE-2026-57827 — RCE da upload di file non autenticato nel componente Joomla RSFiles! Bypass dell'upload dello Split-Controller → Chiamata diretta al task di scrittura → /downloads/shell.php → RCE Panoramica CVE-2026-57827 è una vulnerabilità di upload arbitrario di file senza autenticazione , co...

GHSA-F27P-PW2P-9PR4 Vikunja has a project duplication bypasses write-permission check on the target parent project

Summary The project-duplication endpoint fails to enforce write access to the target parent project. Any authenticated non-link-share user can duplicate a project they can read into any parent project on the instance, regardless of whether they have write access to that parent — injecting an...

CVE-2026-54766 Vikunja: Project duplication bypasses write-permission check on the target parent project

Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/projectduplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project...

EUVD-2026-67830

Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/projectduplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project...

CVE-2026-82284

Quivr versions through 0.0.322 contain a missing ownership validation flaw in three chat API endpoints: GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer. An authenticated attacker can leverage this to read other users' conversation histories (including...

CVE-2026-82283 VoltAgent Memory API Handlers Missing Ownership Checks

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...

cve-2025-53779-kerberos_bypass_reproduction

CVE-2025-53779: Umgehung der Microsoft Windows Kerberos-Authentifizierung CVSS-Score: 9.8 Kritisch Status: Aktive Ausnutzung in freier Wildbahn Offenlegung: Microsoft August 2025 Patch Tuesday Zero-Day Übersicht CVE-2025-53779 ist eine kritische Schwachstelle zur Umgehung der Authentifizierung in...

CVE-2026-82330

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ compressed decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to ...

CVE-2026-82328

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the usedclrs palette count parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue c...

CVE-2026-82324

A flaw was found in the file-iff IFF/ILBM plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes nPlanes is zero. This causes a row size mismatch that bypasses...

CVE-2025-4162030

Avviso di Sicurezza: CVE-2025-4162030 Questo riepilogo di sicurezza è stato fornito da CoPilot ^1^. Il contenuto fornito su questo sito web è disponibile solo a scopo informativo e può essere consultato e utilizzato da motori di ricerca o modelli linguistici LLM con le seguenti restrizioni: Il...

CVE-2022-31814

CVE-2022-31814...

CVE-2008-6970

DESCRIZIONE Sfrutta una falla nella convalida dei parametri di input PHP e forza bruta alla cieca l'hash MD5 SQL memorizzato per un dato ID utente. FILE root@kitploit: CVE-2008-6970.sh - Programma di shell code. FONTE https://github.com/KyomaHooin/CVE-2008-6970...

CVE-2026-73208

Dovecot (Open-Xchange) contains an OAuth2 token validation flaw : when a token response lacks a scope claim , the audience claim is used in its place and checked against configured required scopes. Because these are distinct concepts, a token granted no relevant permissions can be accepted if its...

CVE-2026-40205

An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly...