Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the API request component and related URL-taking components RSS, SearXNG, Web Search, Home Assistant, Glean, Docling, which lack SSRF protection by default. An authenticated attacker can supply a URL...

Server-side Request Forgery (SSRF)

Overview lfx is a lfx is a command-line tool for running Langflow workflows. It provides two main commands: serve and run. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the API request component and related URL-taking components RSS, SearXNG, Web Search,...

Server-side Request Forgery (SSRF)

Overview langflow is an A Python package with a built-in web application Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the API request component and related URL-taking components RSS, SearXNG, Web Search, Home Assistant, Glean, Docling, which lack SSRF...

Server-side Request Forgery (SSRF)

Overview lfx-docling is a Docling document processing components as a standalone Langflow Extension Bundle. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the API request component and related URL-taking components RSS, SearXNG, Web Search, Home Assistant...

CVE-2026-105835

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...

EUVD-2026-93379

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...

BIT-GITLAB-2026-4523 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

BIT-GRAFANA-2026-81842 Library panel can be moved into a folder without library panel create permission

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination...

Arbitrary Code Execution

Apache Syncope is vulnerable to an Arbitrary Code Execution. The vulnerability is due to imported BPMN processes allowing unsandboxed Groovy scriptTask execution, which allows an attacker with sufficient administrative entitlements to import and start a malicious BPMN process through the REST API...

CVE-2026-39794

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

CVE-2026-39794 WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

CVE-2026-39794

The WooCommerce Multivendor Marketplace – REST API plugin for WordPress (versions

EUVD-2026-93038

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

CVE-2026-39794 WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

CVE-2026-105305

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...

CVE-2026-105305

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...

CVE-2026-105305 Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...

CVE-2026-105305

A flaw exists in the OIDC implementation of Keycloak , specifically within the Device Authorization Grant flow . The root cause is that the flow fails to validate the minimum authentication level defined in client configurations. Consequently, an attacker possessing a stolen user password can byp...

EUVD-2026-93019

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...

CVE-2026-105305 Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...