21390 matches found
CVE-2026-10561 Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection
IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in complete compromise...
BIT-NGINX-GATEWAY-2026-42530 NGINX Open-Source ngx_http_v3_module vulnerability
NGINX Open Source has a vulnerability in the ngxhttpv3module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This m...
BIT-NGINX-2026-42530 NGINX Open-Source ngx_http_v3_module vulnerability
NGINX Open Source has a vulnerability in the ngxhttpv3module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This m...
ROS-20260622-73-0043
The vulnerability of the ngxhttpmp4module module in NGINX Open Source web servers is related to integer overflow. Exploiting this vulnerability can allow attackers to cause service failures...
ROS-20260622-73-0044
The vulnerability of the ngxmailsmtpmodule module in NGINX Plus and NGINX Open Source servers is related to the failure to take measures to neutralize CRLF sequences. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...
ROS-20260622-73-0042
The vulnerability of the ngxhttpmp4module in NGINX Plus and NGINX Open Source HTTP servers is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...
NVIDIA NeMo Framework arbitrary code execution vulnerability
NVIDIA NeMo Framework is an open-source generative AI development platform designed specifically for researchers and developers. It aims to efficiently build, customize, and deploy large language models, multimodal models, and voice AI models. The NVIDIA NeMo Framework has a code execution...
ROS-20260622-73-0045
The vulnerability of the ngxmailauthhttpmodule module in NGINX Plus and NGINX Open Source is related to the use of the NULL pointer. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...
ROS-20260622-73-0041
The vulnerability of the ngxhttpdavmodule module in NGINX Plus and NGINX Open Source servers is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow a malicious actor to cause service failures...
MAL-2026-6251 Malicious code in zomato-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a1b48a397992964f8f3982dc69a33431bfb26c911c29a1e5d124581cef46a40 Dependency-confusion package targeting an internal Zomato namespace. The package ships only a stub index.js module.exports = name: 'zomato-config',...
Security Bulletin: Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection
Summary Langflow OSS contains unauthenticated RCE vulnerability in PythonREPLComponent "Python Interpreter". Component's getglobals builds restricted globals dict from globalimports whitelist default: "math" but never sets globals"builtins" = . CPython's exec automatically inserts full builtins...
[SECURITY] Fedora 44 Update: chromium-149.0.7827.155-1.fc44
Chromium is an open-source web browser, powered by WebKit Blink...
RAVEN: Agentic RAG for Automated Vulnerability Repair
Automated vulnerability repair has emerged as a promising direction to mitigate the growing number of software vulnerabilities. Recent advances in Large Language Models LLMs have further accelerated research in automated repair. However, existing frameworks remain largely restricted to...
Linux Distros Unpatched Vulnerability : CVE-2026-48142
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcharsetmodule module. When content is served or proxied through a location block with both...
LangGenius, Inc. Dify has an SSRF vulnerability
Dify is an open-source LLM application development platform. LangGenius, Inc. Dify has an SSRF vulnerability, which allows attackers to obtain sensitive information...
LangGenius, Inc. Dify has an SSRF vulnerability (CNVD-C-2026-287908)
Dify is an open-source LLM application development platform. LangGenius, Inc. Dify has an SSRF vulnerability, which allows attackers to obtain sensitive information...
UBUNTU-CVE-2026-49346
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit depth causes a signed integer overflow in de265imagegetbuffer libde265/image.cc:128. The overflow wraps the plane allocation size to a sma...
security-disclosures-2026
Security Disclosures 2026 Responsible vulnerability disclos...