Electron: Sandboxed iframes can launch external protocol handlers

Impact Requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame's sandbox state was also not made available to the app's permission handlers. Ap...

CVE-2026-70612

The vulnerability CVE-2026-70612 affects Electron. It occurs when web content in sandboxed iframes can trigger external protocol handlers, because iframe sandbox restrictions were not applied to openExternal requests and the frame state wasn’t exposed to permission handlers. This could allow an O...

CVE-2026-70612 Electron: Sandboxed iframes can launch external protocol handlers

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

CVE-2026-70612 Electron: Sandboxed iframes can launch external protocol handlers

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

CVE-2026-70612 Electron: Sandboxed iframes can launch external protocol handlers

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input

A flaw was found in Net::IMAP before 0.4.24, 0.5.14, and 0.6.4. Several commands accept raw string arguments sent to the server without validation or escaping; if derived from user-controlled input, CRLF sequences allow injection of arbitrary IMAP commands...

CVE-2026-17625 Langflow is affected by OS Command Injection in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special element...

CVE-2026-17625 Langflow is affected by OS Command Injection in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special element...

CVE-2026-17625

Langflow OSS versions 1.0.0–1.10.3 are affected by an OS Command Injection in Model Context Protocol features (MCP). The IBM bulletin describes weaknesses in MCP validation, authentication/authorization enforcement, and request handling that could allow a remote authenticated attacker to execute ...

CVE-2026-8446

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol MCP composer endpoint when mcpcomposerenabled=true default and projects are configured with authtype=oauth...

CVE-2026-20301

A vulnerability in the Extensible Messaging Client Protocol XMCP, also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability ...

CVE-2026-20263

A vulnerability in the Blocks Extensible Exchange Protocol BEEP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling when parsing a specific BEEP SOAP...

CVE-2026-20124

A vulnerability in the Simple Network Management Protocol SNMP subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload, resulting in a denial of service DoS condition. This vulnerability is due to improper error handling when parsing...

CVE-2026-17623 Langflow is affected OS Command Injection in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command field in MCP server configurations...

CVE-2026-17623

Langflow OSS 1.0.0–1.10.3 is affected by CVE-2026-17623: a remote authenticated attacker can execute arbitrary commands due to improper validation of the command field in MCP server configurations. Affected product is Langflow OSS (versions 1.0.0–1.10.3). The root cause is inadequate validation o...

CVE-2026-17623 Langflow is affected OS Command Injection in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command field in MCP server configurations...

CVE-2026-17630 Langflow is affected by security vulnerabilities in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to improper validation of configuration parameters...

CVE-2026-17630 Langflow is affected by security vulnerabilities in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to improper validation of configuration parameters...

CVE-2026-17630

Langflow OSS 1.0.0–1.10.3 is affected by CVE-2026-17630, where improper validation of configuration parameters could allow a remote attacker to execute arbitrary code. The issue pertains to Langflow OSS components handling MCP/configuration inputs, enabling code execution with network access and ...

CVE-2026-17626 Langflow is affected by security vulnerabilities in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...