CVE-2026-51886

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...

PoC_CVE-2025-48507

Breaking TrustZone on Zynq UltraScale+ MPSoCs - Proof of Concept for CVE-2025-48507 and CVE-2025-0038 Non-Secure Software could exploit CVE-2025-48507 and CVE-2025-0038 to gain read/write access to Secure World on Zynq UltraScale+ platforms , thereby breaking TrustZone isolation. To that extent,...

fracture

Fracture FragAttacks WiFi Penetration Framework CVE-2020-24586 / CVE-2020-24587 / CVE-2020-24588 Fracture automates three novel attack chains via 802.11 frame injection. It exploits the A-MSDU aggregation vulnerability in WPA2/WPA3 to inject arbitrary plaintext frames into encrypted networks —...

FinRED-paper

FinRED: 金融レッドチーミング評価データセット 金融領域における安全性評価のためのレッドチームベンチマーク生成パイプライン。 補足ドキュメント 論文で参照されている詳細資料: docs/expertvalidation.md — 12名のFSI領域専門家による質問ごとのフォーカスグループインタビューFGI結果一致度、Likertスコア、Cohen's κ / Krippendorff's α。 docs/judgerubric.md — 完全なLLM-as-a-Judge評価テンプレート、5つのルーブリック次元、判定ルール、および出力JSONスキーマ。 docs/schemas.m...

CVE-2026-95687

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing a...

CVE-2026-85235

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

EUVD-2026-90568

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing a...

CVE-2026-95687

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to and including 2.0.0 . The root cause is the plugin's failure to properly validate a target user's role before issuing a new authentication session. An a...

CVE-2026-95687 WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing a...

WordPress WPC Shop as a Customer for WooCommerce plugin <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by clever in WordPress Plugin WPC Shop as a Customer for WooCommerce versions = 2.0.0...

CVE-2026-51886

The langflow-ai langflow application (up to version v1.9.3 ) is vulnerable to a Code Injection vulnerability in the validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 function within src/backend/base/langflow/api/v1/validate.py:13. A public-facing route accepts raw Python source...

CVE-2026-51888

The langflow-ai langflow software (up to version 1.8.4 ) is vulnerable to an absolute path traversal vulnerability within the knowledge_bases-create_knowledge_base-a-live-http-post-to-create_knowledge_base component, specifically located at src/backend/base/langflow/api/v1/knowledge_bases.py:51. ...

CVE-2026-102128

An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision a platform account for an identity it did not already know. A remote, unauthenticated sender could potentiall...

CLEANSTART-2026-CX75671 Cancelling a query (e

Security vulnerability affects the buildkitd package. Cancelling a query e...

CVE-2026-19445

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

CVE-2026-73596

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 are vulnerable to an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with remote access could exploit this flaw to achieve elevation of privileges , information tampering ...

ubl-itel-s23

Unlock Bootloader — Itel S23 S665L / Unisoc T606 Guide to unlock the bootloader on the Itel S23 S665L using the CVE-2022-38694 exploit on the Unisoc T606 UMS9230 chipset. Device Info Property| Value ---|--- Brand| Itel Model| S665L S23 Android| 12 SDK 31 Build|...

CVE-2002-0991

CVE-2002-0991 Buffer overflows in the cifslogin command for HP CIFS/9000 Client A.01.06 and earlier Exploit-db publication at https://www.exploit-db.com/exploits/21577/ Packetstorm publication at https://packetstormsecurity.com/files/26303/cifslogin.txt.html SecurityFocus publication at...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.20.1

cert-manager Operator for Red Hat OpenShift 1.20.1 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

WordPress Request a Quote for WooCommerce plugin <= 2.9.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by t4g0 in WordPress Plugin Request a Quote for WooCommerce versions = 2.9.2...