CVE-2026-0769 Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability

Langflow evalcustomcomponentcode Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2026-0768 Langflow code Code Injection Remote Code Execution Vulnerability

Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code...

CVE-2026-0765

CVE-2026-0765 affects Open WebUI via the Python package Open WebUI/PIP install_frontmatter_requirements, where lack of validation of a user-supplied string before a system call enables a remote code execution in the service account context. Attacker authentication is required to exploit. Multiple...

CVE-2026-0761 Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability

Foundation Agents MetaGPT actionoutputstrtomapping Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foundation Agents MetaGPT. Authentication is not required to exploit this vulnerability. The...

CVE-2026-0757

MCP Manager for Claude Desktop execute-command Command Injection Sandbox Escape Vulnerability. This vulnerability allows remote attackers to bypass the sandbox on affected installations of MCP Manager for Claude Desktop. User interaction is required to exploit this vulnerability in that the targe...

CVE-2026-0756

github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of github-kanban-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2026-0755 gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability

gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2025-15063 Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability

Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ollama MCP Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

PT-2026-4635

CVE-2026-24336 - Apache HTTP Server Unvalidated User Input CVE ID : CVE-2026-24336 Published : Jan. 23, 2026, 5:16 a.m. | 1 hour, 58 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

PT-2026-4634

CVE-2026-24335 - Apache Struts Unvalidated Input CVE ID : CVE-2026-24335 Published : Jan. 23, 2026, 5:16 a.m. | 1 hour, 58 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Open WebUI Code Injection Vulnerability

Open WebUI is an open-source, scalable, feature-rich, and user-friendly self-hosted WebUI. Open WebUI has a code injection vulnerability, which stems from the lack of validation for the string provided by users in the loadtoolmodulebyid function. This vulnerability may lead to code injection and...

Langflow code injection vulnerability

Langflow is an open-source visualization framework developed by Langflow for building multi-agent and RAG applications. Langflow has a code injection vulnerability, which stems from a lack of validation for the strings provided by users when processing code parameters. This vulnerability may lead...

GitHub Kanban MCP Server: Operating System Command Injection Vulnerability

GitHub Kanban MCP Server is an application developed by Maki, a personal developer. The GitHub Kanban MCP Server has a vulnerability related to operating system command injection. This vulnerability arises from executing system calls without validating user input when processing the createissue...

ALGO 8180 IP Audio Alerter: Operating System Command Injection Vulnerability

ALGO 8180 IP Audio Alerter is an IP speaker developed by ALGO Corporation. The ALGO 8180 IP Audio Alerter has a vulnerability related to operating system command injection. This vulnerability stems from the lack of validation for user input strings in the web-based interface, which may lead to...

Open WebUI: Operating System Command Injection Vulnerability

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI under open source. Open WebUI has a vulnerability related to operating system command injection. This vulnerability stems from the lack of validation for the strings provided by users in the...

Aptsys Gemscms POS Platform security vulnerabilities

Aptsys Gemscms POS Platform is a catering management system developed by the Indian company Aptsys. There is a security vulnerability in the Aptsys Gemscms POS Platform. This vulnerability stems from unvalidated endpoints returning payment card credentials encrypted using MD5. It may lead to...

MetaGPT code injection vulnerability

MetaGPT is a multi-agent framework developed by MetaGPT Inc. MetaGPT has a code injection vulnerability, which stems from the actionoutputstrtomapping function’s lack of validation for strings provided by users. This vulnerability may lead to code injection and remote code execution...

Katana Development Starter Kit: Operating System Command Injection Vulnerability

The Katana Development Starter Kit is an open-source development kit developed by Katana Network. The Katana Development Starter Kit has a vulnerability related to operating system command injection. This vulnerability stems from the executeCommand method, which lacks validation of the strings...

WordPress Plugin BuddyPress Code Injection Vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

PT-2026-4638

CVE-2026-24339 - Google Chrome Unvalidated Redirect CVE ID : CVE-2026-24339 Published : Jan. 23, 2026, 5:16 a.m. | 1 hour, 58 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...