Improper Handling of Unicode Encoding

Overview Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding via the NewStringUTF decoding process. An attacker can bypass host-based access controls and influence certificate selection or logging by sending specially crafted overlong UTF-8 encodings in the...

Improper Handling of Unicode Encoding

Overview Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding via the NewStringUTF decoding process. An attacker can bypass host-based access controls and influence certificate selection or logging by sending specially crafted overlong UTF-8 encodings in the...

CVE-2026-116542

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello servername to confuse SNI-based certificate...

CVE-2026-116542

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello servername to confuse SNI-based certificate...

CVE-2026-116542 Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello servername to confuse SNI-based certificate...

Use-after-free of caller-owned server name in client connection constructors

In rustls-ffi 0.12.0 through 0.15.6, rustlsclientconnectionnew and rustlsclientconnectionnewalpn retained a reference to the caller's servername buffer after returning, rather than copying it. The API documentation did not require the buffer to outlive the call and as a result if the caller freed...

rustls-ffi -- Read after free

The RusTLS project reports: functions retained a reference to the caller's servername buffer after returning, rather than copying it. The API documentation did not require the buffer to outlive the call and as a result if the caller freed or reused the buffer, later TLS processing read freed...

Netty TCNative input validation error vulnerability

Versions of netty-tcnative prior to 2.0.84.Final contain an input validation error vulnerability. This vulnerability stems from improper handling of JNI NewStringUTF decoding; remote unauthenticated attackers can send a specially crafted servername containing an excessively long encoded hostname...

EUVD-2026-92788

Langflow: OS command injection RCE via arbitrary command in MCP stdio server configuration...

CVE-2026-105697

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697

Langflow versions prior to 1.10.3 are vulnerable to OS command injection due to a lack of allowlisting in the MCP stdio transport configuration. An attacker capable of accessing MCP server settings or using the MCP Tools component can execute arbitrary OS commands (e.g., rm -rf, reverse shells) o...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697: Improper Neutralization of Special Elements used in an OS Command

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-10158 TRENDnet TEW-432BRP formPortFw stack-based overflow

A security flaw has been discovered in TRENDnet TEW-432BRP 3.10B20. Affected is the function formPortFw of the file /goform/formPortFw. The manipulation of the argument servername results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released t...

CVE-2026-10158: Stack-based Buffer Overflow

A security flaw has been discovered in TRENDnet TEW-432BRP 3.10B20. Affected is the function formPortFw of the file /goform/formPortFw. The manipulation of the argument servername results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released t...

CVE-2019-25346: Improper Neutralization of Special Elements used in an SQL Command

TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the 'servername' parameter. Attackers can inject malicious SQL code like ' or '1=1 to retrieve unauthorized database records and potentially access sensitive system information...

CVE-2019-25311: Improper Neutralization of Input During Web Page Generation

thesystem version 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple server data input fields. Attackers can submit crafted script payloads in operatingsystem, systemowner, systemusername, systempassword,...