CVE-2026-17627: Authorization Bypass Through User-Controlled Key

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization...

CVE-2026-17631: Server-Side Request Forgery (SSRF)

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery SSRF vulnerability...

CVE-2026-18905: Server-Side Request Forgery (SSRF)

IBM ContextForge MCP Gateway mcp-contextforge-gateway = v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation...

CVE-2026-19303: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory...

CVE-2026-19302: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links...

CVE-2026-77822: Server-Side Request Forgery (SSRF)

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding...

CVE-2026-75161

An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to inject arbitrary code into the dpcheck system utility executed as root...

libssh: libssh: denial of service via zero advertised channel packet size

A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service...

CVE-2026-65643

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root...

CVE-2026-65643

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root...

CVE-2026-75132: Improper Neutralization of Special Elements used in an SQL Command

WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting t...

CVE-2026-17203 IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].

IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement...

CVE-2026-9548: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks...

CVE-2026-17203: Improper Authentication

IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement...

CVE-2026-75121: Improper Neutralization of Special Elements used in an OS Command

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...

CVE-2026-18729: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code...

CVE-2026-9491: Server-Side Request Forgery (SSRF)

A server-ide request forgery SSRF vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-19294: Authorization Bypass Through User-Controlled Key

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization...

CVE-2026-65646

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges...

CVE-2026-65646

Plesk contains a vulnerability in its DNS zone management functionality caused by improper neutralization of special elements . Remote authenticated users can exploit this to disclose arbitrary local files and escalate privileges within the system. The CNA-assigned CVSS 3.0 score is 9.9 (Critical...