CVE-2026-97673 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation...

EUVD-2026-94121

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation...

CVE-2026-106226

Improper input validation in Compositing in Google Chrome prior to 155...

CVE-2026-106346

Improper state validation in DevTools in Google Chrome prior to 155.0...

CVE-2026-106299

Improper input validation in WebAudio in Google Chrome prior to 155.0...

CVE-2026-106343

Improper state validation in Autofill AI in Google Chrome on on Androi...

CVE-2026-106206

Improper input validation in Mobile in Google Chrome on on iOS prior t...

CVE-2026-97678

IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by CVE-2026-97678 , which allows a remote authenticated attacker to execute arbitrary code due to improper input validation (CWE-693). The vulnerability has a HIGH base severity score of 8.8 . To remediate this issue, IBM strongly recomm...

CVE-2026-97679

IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by a Code Injection vulnerability (CVE-2026-97679 ). A remote authenticated attacker can execute arbitrary code due to the improper neutralization of special elements used in an OS command, which stems from improper input validation . Th...

CVE-2026-97679 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command 'Code Injection' related to improper input validation...

CVE-2025-3054-Exploit

CVE-2025-3054 漏洞利用： 在此下载 详情 CVE 编号 ：CVE-2025-3054 发布日期 ：2025年6月5日 CVSS ：8.8 可用补丁： （尚无官方补丁） 影响 WordPress 的 WP User Frontend Pro 插件在 4.1.3 及之前的所有版本中，由于 uploadfiles 函数缺少文件类型验证，存在任意文件上传漏洞。这使得具有订阅者（Subscriber）级别及以上访问权限的已认证攻击者能够在受影响站点的服务器上上传任意文件，从而可能导致远程代码执行。请注意，利用该漏洞需要启用“私信”（Private Message）模块，并且需要使用...

CVE-2026-106331

A flaw was found in chromium-browser. Improper input validation within the Extensions component allows a remote attacker to bypass web origin security policies. By using social engineering to convince a user to install a crafted browser extension, an attacker can gain unauthorized access to...

PurpleKeep

描述 随着攻击技术的种类迅速增加，同时 EDR（端点检测与响应）提供的检测规则以及自定义规则数量也在上升，对检测规则进行持续功能测试的需求变得显而易见。然而，手动重复执行这些攻击并与检测规则进行交叉核对是一项劳动密集型任务，值得自动化处理。 为应对这一挑战，我开发了"PurpleKeep"——一个旨在促进检测规则自动化测试的开源项目。利用 Atomic Red Team 项目的能力，该项目允许按照 MITRE TTPs（战术、技术和程序）模拟攻击。PurpleKeep 增强了这些 TTP 的模拟，作为评估检测规则有效性的起点。 在测试环境中自动化模拟一个或多个 TTP...

CVE-2026-43598

A flaw was found in the AMD ROCm Communication Collectives Library RCCL. Due to improper input validation, a network-adjacent attacker or a compromised peer node can supply a crafted memory address that the library accesses without proper verification. This vulnerability could allow an attacker t...

CVE-2024-29973

CVE-2024-29973 - 远程命令注入漏洞 描述 CVE-2024-29973 是某些 Zyxel 网络设备中发现的一个严重漏洞。该漏洞允许未经身份验证的攻击者利用固件中不当的输入验证机制，在目标设备上执行任意命令。攻击者可以向设备发送特制的 HTTP 请求，注入系统级命令，并有可能完全控制设备。 Dorks Hunter: product.name="ZyXEL NAS542"||product.name="ZyXEL NAS326" FOFA: app="NAS542" || app="ZYXEL-NAS326" SHODAN: http.title:"Zyxel NAS32...

CVE-2024-53345

CVE-2024-53345 汽车租赁管理系统 1.0 - 1.3 版本中的严重 0 Day 漏洞 描述： 汽车租赁管理系统（版本 1.0 至 1.3）的系统设置模块文件上传功能中存在一个严重漏洞，允许低权限用户上传任意文件，包括可执行的 PHP 脚本。该漏洞源于文件类型验证不充分以及对上传目录的访问控制不当，使攻击者能够上传恶意文件，并无须身份验证即可公开访问这些文件。 通过利用此缺陷，攻击者可以上传 PHP shell，并随后在已上传文件的 URL 后附加 ?cmd=...

Hipcam-RTSP-Format-Validation-Vulnerability

Hipcam RealServer/V1.0 RTSP 格式验证漏洞概念验证 | CVE-2023-50685 针对 Hipcam RealServer/V1.0 中 RTSP 服务格式验证漏洞的概念验证。 描述 该 PoC 利用了 Hipcam RealServer/V1.0 中实时流媒体协议（RTSP）服务的格式验证漏洞，该漏洞源于对 RTSP SETUP 请求中 'clientport' 参数的输入验证和处理不当。 漏洞详情 RTSP SETUP 请求中的 'clientport' 参数被篡改，从而触发 RTSP...

CVE-2026-106506

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks m...

CVE-2026-106500

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission to create and access Scaffolder tasks...

CVE-2026-106498

Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity...