9674 matches found
GHSA-9C59-2MVC-VFR8 Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints
Summary Langflow's /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources — messages, sessions, build artifacts, and LLM transaction logs — without verifying that the authenticated requester owns the targeted resource. Any authenticated...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the monitor API endpoints, which lack proper ownership enforcement. An attacker can read, modify, rename, or permanently delete another user's messages, sessions, build artifacts, and...
Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints
Summary Langflow's /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources — messages, sessions, build artifacts, and LLM transaction logs — without verifying that the authenticated requester owns the targeted resource. Any authenticated...
idoctorai (>=0.8.4, <=0.8.7), llm-monitor (>=0.8.0, <=0.14.0) potentially affected by CVE-2026-55443 via langchain (0.0.299)
langchain PYPI version 0.0.299 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - idoctorai =0.8.4, =0.8.0, =0.14.0 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...
devtale (>=0.1.2, <=0.1.4), gitmaid (0.1.0) +3 more potentially affected by CVE-2026-55443 via langchain (0.0.251)
langchain PYPI version 0.0.251 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - devtale =0.1.2, =0.1.0, =0.4.0, =0.5.0 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...
bisheng-langchain (0.2.3.1), evo-researcher (0.1.3) +5 more potentially affected by CVE-2026-55443 via langchain (0.0.349)
langchain PYPI version 0.0.349 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - bisheng-langchain 0.2.3.1 - evo-researcher 0.1.3 - friday-agent 0.1.0 - langchain-experimental =0.0.44, =0.14.1, =0.3.0, =0.3.1 Source cves:...
PT-2026-51773
Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.8.7 Description Multiple security issues affect the Crawl4AI Docker API server across several functional areas: - An authentication bypass in the monitor router allows unauthenticated access to destructive...
PT-2026-49852
Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise PT PeopleTools version 8.61 PeopleSoft Enterprise PT PeopleTools version 8.62 Description An issue exists in the Performance Monitor component of Oracle PeopleSoft. This flaw allows an unauthenticated attacker with networ...
PT-2026-51506
Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.8.7 Description A stored cross-site scripting issue exists in the monitor dashboard. The application renders crawl URLs and error messages using innerHTML without proper escaping. This allows an attacker to submit ...
An AI Security Agent for Banking: Multi-Vector Fraud and AML Detection across Retail and Corporate Accounts
Banks simultaneously face signature-based fraud card-not-present attacks, account takeover, ATM cloning and behavioural financial crime structuring, layering, mule networks, business email compromise -- two threat families with fundamentally different detection requirements. Static rule engines...
EUVD-2026-36941
Author Arbitrary File Download in Download Monitor = 5.1.9 versions...
CVE-2026-39489
Author Arbitrary File Download in Download Monitor = 5.1.9 versions...
CVE-2026-39489 WordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary File Download vulnerability
Author Arbitrary File Download in Download Monitor = 5.1.9 versions...
CVE-2026-39489
The CVE-2026-39489 entry details a vulnerability in WordPress Download Monitor plugin versions
CVE-2026-39489 WordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary File Download vulnerability
Author Arbitrary File Download in Download Monitor = 5.1.9 versions...
dbnd-datastage-monitor (>=1.0.4.1, <=1.0.4.3), dkcloudcommand (>=1.0.132rc1, <=1.1.270rc1) +5 more potentially affected by CVE-2026-48526 via pyjwt (1.6.1)
pyjwt PYPI version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - dbnd-datastage-monitor =1.0.4.1, =1.0.132rc1, =0.2.1, =0.1.1rc0, =0.5.3, =1.2.0rc1, =0.0.3a0, =0.1.10 Source cves: CVE-2026-48526 Source advisory:...
Malicious code in vaults-monitor-cron (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b81c6b9e59e86c40858cb47e91d597b3776fea71def7feb3ca11833625fa3923 On npm install, the package's preinstall hook node postinstall.js || true executes automatically. The script collects hostname, username, and current...
Windows Performance Monitor Code Execution
The vulnerability of the Windows Performance Monitor component of the Windows operating system relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
Windows Performance Monitor Code Execution
The vulnerability of the Windows Performance Monitor component of the Windows operating system is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...