CVE-2026-73627

JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...

CVE-2026-73627 JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass

JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...

CVE-2026-73613

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-73613 filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink

filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an ancestor directory with a symlink...

CVE-2026-73604

Flowise (pre-3.1.3) has an incomplete credential redaction vulnerability in GET /api/v1/credentials/:id that exposes decrypted secrets to authenticated users with credentials:view. Impact described includes database connection URLs with passwords, cloud service account JSON with private keys, and...

EUVD-2026-57808

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...

CVE-2026-73604 Flowise before 3.1.3 Credential Exposure via API

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...

CVE-2026-73601 Flowise before 3.1.3 Remote Code Execution via Custom MCP

Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and...

CVE-2026-73601

Flowise

EUVD-2026-57806

Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-108)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user who is authorized to manage maintenance window...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-80)

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges ca...

CVE-2026-11840

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...

CVE-2026-14298

CVE-2026-14298 affects Mattermost releases: 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, and 10.11.x ≤ 10.11.22. An authenticated user can trigger denial of service by causing resource exhaustion while processing certain user-supplied input. The CVE has a base score of 6.5 (MEDIUM) under CV...

CVE-2026-11840

Affected software : Zohocorp ManageEngine Password Manager Pro (versions before 13232) and ManageEngine PAM360 (versions before 8552). Vulnerability : authenticated SQL injection in these products. Root cause/impact : vulnerability exists in auth context allowing SQL injection with user credentia...

EUVD-2026-57740

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...

CVE-2026-11840

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...

CVE-2026-11840 SQL Injection

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...

AVEVA Enterprise SCADA

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to tamper with serialized data, potentially resulting in code execution during deserialization. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of...

EUVD-2026-57689

In OpenStack Designate before 22.0.1, zone creation checks issubzone, issuperzone, and the duplicate-zone DB constraint are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an...