CVE-2026-25750: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Langchain Helm Charts are Helm charts for deploying Langchain applications on Kubernetes. Prior to langchain-ai/helm version 0.12.71, a URL parameter injection vulnerability existed in LangSmith Studio that could allow unauthorized access to user accounts through stolen authentication tokens. The...

PT-2026-23069

Name of the Vulnerable Software and Affected Versions Langchain Helm Charts versions prior to 0.12.71 Description Langchain Helm Charts, used for deploying Langchain applications on Kubernetes, had a flaw where a specially crafted link could lead to the theft of authentication tokens. This allowe...

Langchain Helm Charts 注入漏洞

Langchain Helm Charts is a Kubernetes Helm chart library developed by LangChain for deploying Langchain applications. Versions of Langchain Helm Charts prior to 0.12.71 contained a injection vulnerability. This vulnerability stemmed from URL parameter injections in LangSmith Studio, which could...

CVE-2026-3432 Sim Studio AI - Unauthenticated OAuth Token Theft

On SimStudio version below to 0.5.74, the /api/auth/oauth/token endpoint contains a code path that bypasses all authorization checks when provided with credentialAccountUserId and providerId parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying their...

CVE-2026-3432 Sim Studio AI - Unauthenticated OAuth Token Theft

On SimStudio version below to 0.5.74, the /api/auth/oauth/token endpoint contains a code path that bypasses all authorization checks when provided with credentialAccountUserId and providerId parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying their...

CVE-2026-3431 Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including...

CVE-2026-3431 Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including...

Sim Studio 安全漏洞

Sim Studio is an open-source AI agent workflow builder developed by Sim Studio. Versions of Sim Studio prior to 0.5.74 contained security vulnerabilities. These vulnerabilities stemmed from authorization checks bypassed in the/api/auth/oauth/token endpoint, which could allow unverified attackers ...

Studio Fabryka DobryCMS 代码问题漏洞

Studio Fabryka DobryCMS is a content management system developed by Studio Fabryka. Versions of Studio Fabryka DobryCMS prior to version 5.0 had code vulnerabilities. These vulnerabilities stemmed from defects in the file upload functionality, which could lead to remote code execution...

Studio Fabryka DobryCMS SQL注入漏洞

Studio Fabryka DobryCMS is a content management system developed by Studio Fabryka. Versions of Studio Fabryka DobryCMS prior to version 8.0 had a SQL injection vulnerability. This vulnerability stemmed from SQL injections in URL paths, which could lead to blind injection attacks...

Sim Studio 安全漏洞

Sim Studio is an open-source AI agent workflow builder developed by Sim Studio. Versions of Sim Studio prior to 0.5.74 contained security vulnerabilities. These vulnerabilities stemmed from MongoDB tool endpoints accepting arbitrary connection parameters, which could allow unauthorized access to...

Visual Studio Code Live Server Unauthorized Access

The vulnerability of the Live Server extension of the Visual Studio Code editor relates to the lack of protective measures for website structures. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information through a specially created HTML page...

Visual Studio Code Markdown Preview Enhanced Code Execution

The vulnerability of the Visual Studio Code Markdown Preview Enhanced editor extension is related to improper handling of code generation. Exploiting this vulnerability allows an attacker to execute arbitrary code by loading a specially created file with the extension .Md...

Security Bulletin: Vulnerability in IBM® Java SDK affects WebSphere Service Registry and Repository due to CVE-2026-1188

Summary A buffer overflow vulnerability in IBM® SDK, Java™ Technology Edition affects IBM WebSphere Service Registry and Repository. This issue is also addressed by WebSphere Application Server shipped with WebSphere Service Registry and Repository. Vulnerability Details CVEID:CVE-2026-1188...

MAL-2026-1020 Malicious code in @ai-studio-web/app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a29e5e23697b695bdd456d100ba49a1ef5c6f4450b46672dedcd164a073e8eb The package @ai-studio-web/app was found to contain malicious code. Source: ghsa-malware...

Malicious code in @ai-studio-web/app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a29e5e23697b695bdd456d100ba49a1ef5c6f4450b46672dedcd164a073e8eb The package @ai-studio-web/app was found to contain malicious code. Source: ghsa-malware...

kyoukai (>=2.2.0, <=2.2.1), mezmorize (>=0.18.1, <=0.25.0) +2 more potentially affected by CVE-2026-27199 via werkzeug (0.13.0)

werkzeug PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - kyoukai =2.2.0, =0.18.1, =0.49.2, =0.0.0.1, =0.0.3 Source cves: CVE-2026-27199 Source advisory: OSV:PYSEC-2026-2320...

kyoukai (>=2.2.0, <=2.2.1), mezmorize (>=0.18.1, <=0.25.0) +2 more potentially affected by CVE-2026-27199 via werkzeug (0.13.0)

werkzeug PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - kyoukai =2.2.0, =0.18.1, =0.49.2, =0.0.0.1, =0.0.3 Source cves: CVE-2026-27199 Source advisory: OSV:GHSA-29VQ-49WR-VM6X...

📄 Sawtooth Lighthouse Studio 9.16.14 Remote Command Execution

Sawtooth Lighthouse Studio version 9.16.14 proof of concept remote command execution exploit. ============================================================================================================================================= | Title : Sawtooth Lighthouse Studio 9.16.14 RCE | | Author :...

Critical Flaws Found in Four VS Code Extensions with Over 125 Million Installs

Cybersecurity researchers have disclosed multiple security vulnerabilities in four popular Microsoft Visual Studio Code VS Code extensions that, if successfully exploited, could allow threat actors to steal local files and execute code remotely. The extensions, which have been collectively...