CVE-2026-59717: URL Redirection to Untrusted Site

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

PT-2026-69142

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2026.8.1 Description The Companion app processes tag links NFC or QR received via OS-level routing as physical scans without validating the source app or requesting user confirmation. This allows an untrusted...

ironclaw ironclaw-v1.1.0

IronClaw Your secure personal AI assistant, always on your side English | 简体中文 | Русский | 日本語 | 한국어 Reborn Quick Start • Philosophy • Features • Installation • Configuration • Security • Architecture IronClaw Reborn Quick Start IronClaw Reborn is the standalone runtime on the reborn-integration...

CVE-2026-61963

Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...

CVE-2026-61963 WordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...

CVE-2026-61963

Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...

CVE-2026-61963 WordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...

CVE-2026-61963

WordPress Media Library Assistant plugin ≤ 3.38 has an unauthenticated XSS vulnerability. The CVE and connected records describe unauthenticated cross-site scripting in versions up to 3.38. No root-cause, exploit details, or remediation are provided in the documents; further specifics on impact a...

EUVD-2026-53958

Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...

CVE-2026-61963: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...

IBM Langflow OSS Code Execution Vulnerability (CNVD-2026-32369)

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a code execution vulnerability. This vulnerability stems from the failure to properly handle components generated by the LLM during the Agentic Assistant validation process. T...

CVE-2026-9196

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user...

CVE-2026-9196

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user...

CVE-2026-9196

IBM Langflow OSS 1.0.0–1.10.3 is affected by an authenticated code-execution risk during Agentic Assistant validation caused by improper handling of LLM-generated components. The backend may execute model-generated Python code in the validation step before user approval, enabling an attacker to t...

CVE-2026-9196

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user...

MAL-2026-13100 Malicious code in bpm-foundation-ai-assistant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13f246c1580a9d0a9035c63c1781c411db9cae7a812f175f6b7ad18a3f2336aa index.js unconditionally requires./loader on package load. loader.js assembles Cloudflare Workers hostnames from string-array joins...

CVE-2026-71247

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path...

CVE-2026-71247 Documenso - Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path...

CVE-2026-71247 Documenso - Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path...

CVE-2026-71247

Documenso CVE-2026-71247 affects the sign-field-with-token.ts path used by the live document-signing UI. A recipient with the ASSISTANT role can fetch and complete fields for any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. The handler up...