136 matches found
CVE-2026-21445
CVE-2026-21445 (Langflow) : Multiple critical API endpoints expose data and allow destructive actions due to missing authentication controls. Affected endpoints include GET /api/v1/monitor/messages, GET /api/v1/monitor/transactions, and DELETE /api/v1/monitor/messages/session/{session_id}. Eviden...
PT-2026-1123
Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.7.0.dev45 Description Langflow, a tool for building and deploying AI-powered agents and workflows, has several critical API endpoints missing authentication controls. This allows any unauthenticated user to access...
EUVD-2020-10387
Malware in sbrugna...
EUVD-2003-1255
Malware in sbrugna...
EUVD-2008-0795
Malware in sbrugna...
EUVD-2021-21079
Malware in sbrugna...
EUVD-2020-27990
Malware in sbrugna...
EUVD-2018-19417
Malware in sbrugna...
EUVD-2018-6872
Malware in sbrugna...
EUVD-2023-1734
Malicious code in bioql PyPI...
EUVD-2024-45361
Malicious code in bioql PyPI...
EUVD-2023-53916
Malicious code in bioql PyPI...
EUVD-2023-32025
Malicious code in bioql PyPI...
EUVD-2024-34005
Malicious code in bioql PyPI...
EUVD-2023-0836
Malicious code in bioql PyPI...
CVE-2024-11353
The SMS for Lead Capture Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deletemessage function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and...
CVE-2024-51488
Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens when users delete messages. This vulnerability could be exploited to forge CSRF attacks, allowing an attacker to delete messages to any...
CVE-2023-4023
The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger...
CVE-2023-0487
The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement when deleting messages, leading to a SQL injection exploitable by high privilege users such as admin...