2601 matches found
Advantech R-SeeNet - Cross-Site Scripting
Advantech R-SeeNet contains a cross-site scripting vulnerability in the devicegraphpage.php script via the graph parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. id: CVE-2021-21801 info: name: Advantech R-SeeNet - Cross-Site Scripting author: gy74...
CVE-2026-72922
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, AutoGPT's autogptplatform/backend/backend/api/features/integrations/router.py webhookingressgeneric route selected getwebhookmanagerprovider from the untrust...
CVE-2026-73158
CVE-2026-73158 affects cti-transmute; saved graph configurations can include style properties and an svgIcon value that Pivotick may render as HTML, enabling script execution in other viewers’ browsers. Root cause: insufficient validation of saved graph configuration data. The fix adds a strict s...
CVE-2026-72751
CTI-Transmute is affected by a stored cross-site scripting XSS vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without...
CVE-2026-72751
CTI-Transmute’s conversion graph is affected by a stored XSS in the Pivotick-based UI. Attacker-controlled CTI data could inject HTML/JS into node labels, edge labels, node properties, edge properties, and node types, with HTML rendering paths and a vulnerable raw-JSON usage via document.write. T...
CVE-2026-72751
CTI-Transmute is affected by a stored cross-site scripting XSS vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without...
EUVD-2026-55633
CTI-Transmute is affected by a stored cross-site scripting XSS vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without...
EUVD-2026-54785
A vulnerability was detected in aaronsb memory-graph up to 5cfd2382778837b9f6399080956eee670d00452c. Affected by this vulnerability is the function JsonMemoryStorage.createDomain/JsonMemoryStorage.getMemories/JsonMemoryStorage.saveMemories of the file src/tools/memoryTools.ts. The manipulation...
CVE-2026-19285
CVE-2026-19285 affects aaronsb memory-graph (memoryTools.ts: JsonMemoryStorage.createDomain, JsonMemoryStorage.getMemories, JsonMemoryStorage.saveMemories). The root cause is path traversal in these functions; exploitation requires local access. No version details for affected/updated releases ar...
CVE-2026-61808
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...
CVE-2026-61808 LightRAG: Missing Authentication for Critical API Functions in Default Configuration
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...
CVE-2026-61808
CVE-2026-61808 affects LightRAG up to version 1.5.4, where the API server binds to all network interfaces with authentication disabled by default. This allows an unauthenticated network attacker to read indexed documents, upload or delete documents, modify the knowledge graph, cancel pipelines, c...
CVE-2026-63637
CVE-2026-63637 affects Dgraph. Prior to 25.3.8, the may beQuoteArg logic in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, enabling a crafted GraphQL query or mutation filter to inject DQL operators, disclos...
CVE-2026-10547
IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/flowid/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized...
CVE-2026-10547
IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/flowid/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized...
CVE-2026-10547 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement
IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/flowid/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized...
CVE-2026-10547
IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/flowid/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized...
CVE-2026-10547
Summary (concrete details available) Langflow OSS versions 1.0.0–1.10.3 are affected by an ownership validation flaw in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint. An authenticated user can inject arbitrary graph data into a shared cache for any flow, enabling cross-user cache ...