CVE-2026-19010

Technical details about CVE-2026-19010 are not publicly available in the provided documents; monitor for updates.

CVE-2026-19010 TinyAGI Message API Endpoint index.ts processMessage authorization

A security vulnerability has been detected in TinyAGI 0.0.20. Impacted is the function processMessage of the file packages/main/src/index.ts of the component Message API Endpoint. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed...

CVE-2026-19009 TinyAGI Message API Endpoint response.ts collectFiles file inclusion

A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core/src/response.ts of the component Message API Endpoint. This manipulation causes file inclusion. The attack can be initiated remotely. The exploit has been made available to the...

CVE-2026-19007 mf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management

A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/reply/reply-elevated.ts. This manipulation causes improper privilege management. It is possible to initiate the attack remotely. The explo...

CVE-2026-18967

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...

CVE-2026-18995 netease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure

A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler. This manipulation causes information disclosure. The attack is possible to be carried out...

CVE-2026-16636

The CVE concerns FluentSMTP

Linux Distros Unpatched Vulnerability : CVE-2026-67863

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UASubscriptionlocalPublish continues to...

PT-2026-68837

Name of the Vulnerable Software and Affected Versions Microsoft Teams affected versions not specified Description Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer...

EulerOS 2.0 SP13 : bind (EulerOS-SA-2026-2957)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving a...

PT-2026-68772

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.7.9 macOS Sonoma versions prior to 14.8.9 macOS Tahoe versions prior to 26.6.1 Description An authentication issue exists in Screen Sharing due to improper state management. This flaw allows a network-based...

CVE-2026-71311

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-18958

The CVE-2026-18958 entry concerns imranrisal-dev Student-Management-System. Affected component is the Login function’s loginCheckTest.php where manipulation of username/password parameters leads to SQL injection. The vulnerability is reported as remotely exploitable, with exploit code publicly av...

CVE-2026-17633 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection...

CVE-2026-8183

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot "...

CVE-2026-70448

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

CVE-2026-70437

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...

CVE-2026-20263

A vulnerability in the Blocks Extensible Exchange Protocol BEEP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling when parsing a specific BEEP SOAP...

CVE-2026-17626

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...

EUVD-2026-53452

A vulnerability in the Blocks Extensible Exchange Protocol BEEP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling when parsing a specific BEEP SOAP...