Security Bulletin: Langflow is affected by weaknesses in secret handling and sensitive configuration access

Summary Langflow includes features for secret protection, environment access, and runtime configuration of workflow components. Weaknesses in cryptographic key handling, exposure of process environment values, and insufficient restriction of sensitive runtime configuration fields could allow...

Improper Authentication

Keycloak is vulnerable to Improper Authentication. The vulnerability is due to incorrect handling of SAML identity provider metadata that lacks key usage attributes, which allows an unauthenticated attacker to bypass SAML signature validation, forge a SAML response, and gain unauthorized access t...

CVE-2026-6826

creationtimestamp| type| source ---|---|--- 2026-08-24 06:44:22+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/concretecmsfileusagedisclosure.rb 2026-09-08 06:47:30+00:00| seen|...

GHSA-22W5-2FXG-VRWX OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers

Impact Unauthenticated denial of service. Summary When OpenTofu performs requests against an untrusted or compromised third-party server or connects to an attacker-controlled server, the initial connection negotiation can produce high CPU usage, leading to possible denial of service. These...

JLSEC-2026-1347 aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers...

aria2c accepts a server certificate with incorrect Extended Key Usage EKU. If the attackers compromise a certificate with the associated private key issued for a different purpose, they may be able to reuse it for TLS server authentication...

K000163005: react-server-dom vulnerability CVE-2026-23870

Security Advisory Description A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpac...

CVE-2026-73197 Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

BIT-GITLAB-2026-19228 Authorization Bypass Through User-Controlled Key in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information...

ANT-2026-ZJXVWQEA · flex · Heap Buffer Overflow

heap-buffer-overflow low Severity Claude low · Security research firm low · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-ZJXVWQEA: Heap buffer overflow in sfinit due to stale...

bind9.18 security update

An update is available for bind9.18. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Na...

EUVD-2026-59962

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation,...

CVE-2026-74797: Uncontrolled Resource Consumption

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation,...

CVE-2026-72260

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Check runtime resume during probe The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pmruntimegetsync without checking the return value. If...

UBUNTU-CVE-2026-72260

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Check runtime resume during probe The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pmruntimegetsync without checking the return value. If...

CVE-2026-72260 ASoC: mediatek: mt8192: Check runtime resume during probe

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Check runtime resume during probe The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pmruntimegetsync without checking the return value. If...

CVE-2026-72260 ASoC: mediatek: mt8192: Check runtime resume during probe

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Check runtime resume during probe The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pmruntimegetsync without checking the return value. If...

PostgreSQL fails to check type USAGE privilege

...

CVE-2026-72260: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Check runtime resume during probe The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pmruntimegetsync without checking the return value. If...

PT-2026-80569

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension...

Vulnerability in core server (CVE-2026-6470)

PostgreSQL fails to check type USAGE privilege Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subty...