CVE-2026-10562

creationtimestamp| type| source ---|---|--- 2026-06-30 21:56:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjymnc2dq25...

CVE-2026-9106

creationtimestamp| type| source ---|---|--- 2026-06-30 21:54:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjyjnm3on24...

CVE-2025-12530

creationtimestamp| type| source ---|---|--- 2026-06-30 21:53:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjygswnxx2k 2026-07-01 18:48:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpm6lpl47j2r 2026-07-02 01:36:48+00:00| seen|...

Malicious code in @businessapp-microsites/apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b70ab5da6865ec94b15097fa84836ab41f39b65a5277974b407c545d8d424c7f @businessapp-microsites/[email protected] is a dependency-confusion squat against the private scope @businessapp-microsites, published with an implausibl...

CVE-2026-7871

IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data, and system integrity...

CVE-2026-10546

IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery SSRF vulnerability in the URL component src/lfx/src/lfx/components/datasource/url.py due to a Time-of-Check/Time-of-Use TOCTOU race condition that can be exploited via DNS rebinding...

CVE-2026-12073

creationtimestamp| type| source ---|---|--- 2026-06-30 20:17:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpjt37jnli2e...

EUVD-2026-40401

IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buildpublictmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service...

CVE-2026-10560 Unauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSS

IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buildpublictmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service...

CVE-2026-7663

Langflow OSS 1.0.0–1.9.6 is affected by an improper authorization vulnerability in the Streamable MCP transport endpoint (/api/v1/mcp/project/{project_id}/streamable) that allows unauthenticated attackers to access protected MCP resources and perform MCP operations. IBM bulletin cites cross‑user ...

EUVD-2026-40380

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanism for encryption at rest...

GHSA-H8VQ-8GPG-MHCG Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

Description This is a residual bypass of CVE-2026-46635 / GHSA-vcc8-phrv-43wj that only affects sandboxing enabled through SourcePolicyInterface and not the regular global sandbox mode. CoreExtension::column receives the active sandbox state via the needsissandboxed channel as a boolean...

CVE-2026-58376

creationtimestamp| type| source ---|---|--- 2026-06-30 18:30:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjn5cyb4w2m 2026-07-03 10:06:32+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpqce4xggx2r 2026-07-03 10:06:33+00:00| seen|...

CVE-2026-58372

creationtimestamp| type| source ---|---|--- 2026-06-30 18:25:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjmudi45y2u 2026-07-02 05:56:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpndwv4afe2t...

EUVD-2026-36099

Fission Container Executor Function PodSpec Injection Leading to Node Escape...

CVE-2026-10655

creationtimestamp| type| source ---|---|--- 2026-06-30 18:17:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjmfwxtzh2v...

CVE-2026-12560

creationtimestamp| type| source ---|---|--- 2026-06-30 18:17:11+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpjmeqasoq2c...

EUVD-2026-36096

Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook...

Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook

Summary A Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; PackageRef.Namespace was not. Details A tenant with functions.fission.io/create in their own namespace could set...

CVE-2026-58371

creationtimestamp| type| source ---|---|--- 2026-06-30 18:14:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjm7xuynj24 2026-07-02 05:52:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpndoycmhy2i...