Langflow OSS <=1.12.2 - Unauthenticated RCE via Import Code Execution

Langflow OSS 1.0.0 through 1.12.2 is vulnerable to unauthenticated remote code execution via the POST /api/v1/validate/code endpoint, which calls importlib.importmodule on user-supplied import statements, executing module top-level code instead of merely validating syntax. Combined with the defau...

CVE-2026-104078

Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the...

PT-2026-107793

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 9.2.2d Brocade Fabric OS versions 10.0.0 through 10.0.0a1 Description An OS command injection issue exists in maintenance command-line diagnostic utilities. The binary fails to sanitize user-supplied input...

EUVD-2026-92788

Langflow: OS command injection RCE via arbitrary command in MCP stdio server configuration...

CVE-2026-106510

The Backstage open framework for developer portals is vulnerable to remote code execution in versions prior to 1.14.6 . The flaw exists in the @backstage/plugin-techdocs-node package, where an authenticated user capable of registering catalog entities can provide a crafted mkdocs.yml file. This i...

CVE-2026-105697

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697: Improper Neutralization of Special Elements used in an OS Command

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

PT-2026-106232

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.10.3 langflow-base versions prior to 0.10.3 lfx versions prior to 1.10.3 Description An issue exists in the MCP stdio transport where the software executes commands and arguments provided in an MCP server...

Exploit for Argument Injection in Thecodingmachine Gotenberg

CVE-2026-40281 Gotenberg --- 📖 Table of...

AlmaLinux 9.2 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.2:CLSA-2026:1778858288)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778858288 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command...

AlmaLinux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1778856286)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778856286 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command...

Rocky Linux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1778856286)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778856286 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command...

Multiple vulnerabilities in Image Scanner Driver for Linux

Overview Image Scanner Driver for Linux provided by PFU Limited contains multiple vulnerabilities listed below: OS Command Injection CWE-78 - CVE-2026-78229 Link Following CWE-59 - CVE-2026-81310 Nir Yehoshua of Cipher Security Labs reported these vulnerabilities to PFU Limited and coordinated...

CVE-2026-78229

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations...

CVE-2026-78229

The Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker with the ability to log in to a Linux system where the affected product is installed may execute arbitrary OS commands by making specific preparations. Exploitation details are not provided in the docum...

CVE-2026-78229

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations...

EUVD-2026-89569

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations...

CVE-2026-78229

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations...

PT-2026-102996

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations...

CVE-2026-78229: Improper Neutralization of Special Elements used in an OS Command

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations...