CVE-2026-110193

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server...

CVE-2026-110193 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server...

CVE-2026-110193

IBM Langflow OSS versions 1.0.0 through 1.12.8 are affected by a code injection vulnerability (CWE-94). A remote attacker with a low-privileged authenticated account can manipulate the Agentic Assistant to generate or submit component code using unblocked patterns. This can lead to arbitrary oper...

PT-2026-132233

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server...

CVE-2026-110193: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to…

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server...

CVE-2026-61567

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-115904

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks routine in utils.js. An attacker who controls a target URL can...

CVE-2026-115904 Topluyo Desktop for Linux has an OS Command Injection issue

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks routine in utils.js. An attacker who controls a target URL can...

CVE-2026-61567: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-109122

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system...

EUVD-2026-107653

In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster...

PT-2026-121670

Name of the Vulnerable Software and Affected Versions Kiloview E3 NDI encoder affected versions not specified Description The network management service fails to sanitize a field used during the configuration of static routes via the web management API. An authenticated user with permissions to...

CVE-2026-76298

In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster...

CVE-2026-76298 Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster...

CVE-2026-76298

In Splunk Enterprise versions below 10.4.4 and 10.2.8 , a security flaw exists in the PostgreSQL sidecar service due to the use of a hard-coded cryptographic key . Specifically, the service derives a privileged database password from the search head cluster identifier, which is exposed in search ...

CVE-2026-76298 Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster...

PT-2026-120856

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.4 Splunk Enterprise versions prior to 10.2.8 Description A user without admin or power roles can derive the PostgreSQL sidecar database superuser password. This occurs because the PostgreSQL sidecar...

Splunk Enterprise encryption issue vulnerability

Versions prior to Splunk Enterprise 10.4.4 and 10.2.8 contain an encryption-related vulnerability. This vulnerability arises because the PostgreSQL sidecar service derives privileged database passwords from cluster identifiers found in searchable log entries. As a result, users lacking “admin” or...

Splunk Enterprise code injection vulnerability

Versions prior to Splunk Enterprise 10.4.3, 10.2.8, 10.0.11, and 9.4.16 contain a code injection vulnerability. This vulnerability arises from insufficient restrictions on expression syntax when processing user-controllable expressions within the Splunk Web Evaluation Manager XML. As a result,...

ATSUMI Electric ADX5004: Processing logic error vulnerability

The ATSUMI Electric ADX5004 has a processing logic vulnerability. This vulnerability stems from a hidden function issue, allowing users with administrator privileges to execute arbitrary operating system commands...