208262 matches found
CVE-2026-9130 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...
CVE-2026-7869
CVE-2026-7869 : IBM Langflow OSS (versions 1.0.0 through 1.10.3) is affected by a path traversal in the Knowledge Bases API via POST /api/v1/knowledge_bases. User-supplied knowledge base names are used directly to create file paths without proper sanitization, allowing an authenticated attacker t...
CVE-2026-70432
A cross-site request forgery CSRF vulnerability in Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM...
CVE-2026-70432
A cross-site request forgery CSRF vulnerability in Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM...
CVE-2026-70431
Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM...
jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...
jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...
jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...
MAL-2026-13327 Malicious code in dolyame-boxy-independent-bnpl-scheme (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce523b3385816616192d462b5ac251d22886682d021200c4bd76bd22b95003c On require of this package, index.js loads setup.js which downloads a platform-specific native binary from author-controlled Cloudflare Workers hosts...
libpng: libpng: Arbitrary code execution due to use-after-free vulnerability
A flaw was found in libpng, a library used for processing PNG Portable Network Graphics image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can...
postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory
A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as loexport, loread, lolseek64, and lotell64. This allows the superuser to send an arbitrarily large response, overwriting the client's...
Malicious code in log-min (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9 The package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the...
Malicious code in hubert-verify-primary-email-am (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6b673dd1185ee4ae8ee19ec605dc7f25eebf55c0583be7c5cb878d331e70db3 [email protected] presents itself as an email-verification library but on require of index.js loads init.js, which reconstructs...
Malicious code in william-data-formatter-x (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df0b15d8ca8cdfac8baf861a2db501b3b52eb0e41fd44a6690c351bda8c90835 The package declares a preinstall script node index.js that, on Windows, spawns a hidden PowerShell window -WindowStyle Hidden to fetch...
The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.
The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
The vulnerability of the Directum Web Agent component of the Directum RX system, which arises due to insufficient validation of input data, allows a perpetrator to execute arbitrary code.
The vulnerability of the Directum Web Agent component of the Directum RX system exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially crafted file...
The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of memory after it is freed, allowing an attacker to execute arbitrary code.
The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
EUVD-2026-53044
NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability CWE-428. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...
CVE-2026-66839
CVE-2026-66839 concerns NetKids iMark from Integrated Systems Technologies, Inc., with an Unquoted Search Path or Element (CWE-428). The issue allows an authenticated attacker to execute arbitrary code with SYSTEM privileges via a local attack vector. Affected software is specified as NetKids iMa...