15839 matches found
CVE-2026-7646 Langflow is affected by security vulnerabilities in Model Context Protocol features
IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP resources/read request with a URL-encoded path...
CVE-2026-7646 Langflow is affected by security vulnerabilities in Model Context Protocol features
IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP resources/read request with a URL-encoded path...
CVE-2026-7646
CVE-2026-7646 affects IBM Langflow OSS 1.0.0–1.10.3. Affected component: Model Context Protocol (MCP) resources/read handling. Root cause: URL-encoded path traversal in the filename enables a crafted MCP request to read arbitrary server files (including other users’ documents, JWT signing secret,...
CVE-2026-9077 Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system...
MINI-XW64-4H99-G7WF
Bulletin has no description...
MINI-436X-868W-V65W
Bulletin has no description...
MINI-XFRR-G99W-V58R
Bulletin has no description...
MINI-M845-R3MF-MQC5
Bulletin has no description...
MINI-VQMV-F44M-23XC
Bulletin has no description...
MINI-HXF2-X8CH-P944
Bulletin has no description...
MINI-27P7-34MC-MW35
Bulletin has no description...
MINI-RW55-M27M-3GR5
Bulletin has no description...
vuln-agent
vuln-agent AI-powered vulnerability scanner + exploit-researc...
Astra Linux – Vulnerability in Firefox
Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11...
recon-arc
ReconARC 🔍 Advanced Reconnaissance & Attack-path Ranking Co...
EUVD-2026-53315
Crater's NotePolicy checks only a blanket Bouncer ability manage-all-notes / view-all-notes with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify $user-hasCompany$model-companyid. NotesController's show, update, and destroy actions authori...
CVE-2026-55739
Crater isolates data per companyid, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and -hasCompany-companyid. CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound custome...
MINI-RWR4-XJ85-V486
Bulletin has no description...