EUVD-2026-67951

IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2026-18729

IBM Langflow OSS versions 1.0.0 through 1.11.1 are affected by a code injection flaw (CWE-94). The PythonFunction component lacks the runtime code-execution gate applied to other components, allowing a remote authenticated attacker to bypass the allow_custom_components=false hardening policy via ...

CVE-2026-82290 Chainlit Feedback Endpoints Missing Ownership Validation

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation...

CVE-2026-82290

Chainlit through version 2.12.0 fails to validate ownership of feedback records in its PUT and DELETE endpoints. The root cause is a missing ownership check, allowing authenticated attackers to delete or modify other users' feedback by supplying arbitrary feedback identifiers. The practical conse...

CVE-2024-7593

CVE-2024-7593 विवरण: CVE-2024-7593 एक गंभीर कमजोरी है जो कई Pulse Secure उत्पादों को प्रभावित करती है, जिसमें Pulse Secure VPN भी शामिल है। यह कमजोरी एक प्रमाणित हमलावर को प्रबंधन इंटरफ़ेस तक पहुंच के साथ प्रभावित सर्वर पर मनमाने कमांड निष्पादित करने की अनुमति देती है। इससे दुर्भावनापूर्ण कोड का...

exploit-CVE-2016-8016-25

McAfee Virus Scan per Linux: molteplici vulnerabilità remote QUESTO EXPLOIT E TUTTO IL CODICE IN QUESTO REPO SONO STATI RIMOSSI PER EVITARE QUALSIASI PROBLEMA RELATIVO ALLA VIOLAZIONE DI QUALSIASI LICENZA MCAFEE McAfee VirusScan Enterprise for Linux è una soluzione antivirus aziendale di McAfee. ...

EUVD-2026-67681

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-52681

Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed,...

CVE-2026-40013

An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of...

EUVD-2026-67662

An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are...

CVE-2026-3129 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...

CVE-2026-38698-and-CVE-2026-38699

Pesquisa sobre Wyze Cam Pan v3 Slides Referência CVE-2026-38698 Nome do Ataque Estouro de heap na função tutkpacketalloc em tutkavserver Detalhes Adicionais Produto Afetado TUTK SDK v.3.1.10.0 até v.4.3.8.1 Componente Afetado função tutkpacketAlloc Vetor de Ataque Um atacante autenticado deve...

EUVD-2026-67292

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

CVE-2022-48311

CVE-2022-48311 Vulnerabilità di Cross Site Scripting XSS nella pagina di configurazione HTTP della stampante HP Deskjet 2540 serie con versione firmware CEP1FN1418BR e numero modello prodotto A9U23B Descrizione Cross Site Scripting XSS nella stampante HP Deskjet 2540 serie con versione firmware...

CVE-2026-78037

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

CVE-2026-78037

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface . An authenticated attacker can execute arbitrary operating system commands with elevated privileges, potentially leading to unauthorized access to sensitive information or complete device compromise ...

CVE-2024-21689

CVE-2024–21689 RCE Bamboo Data Center e Server Atlassian Punteggio CVSS - 7.6 🔥 Descrizione Questa vulnerabilità RCE Remote Code Execution ad alta gravità, CVE-2024-21689, è stata introdotta nelle versioni 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 e 9.6.0 di Bamboo Data Center e Server. Questa...

CVE-2025-54897-LAB

Lab: CVE-2025-54897 - Vulnerabilità di deserializzazione in Microsoft Office SharePoint 🚀 Panoramica Questo lab dimostra una vulnerabilità di deserializzazione in Microsoft Office SharePoint che consente l'esecuzione remota di codice RCE. Il problema deriva dalla gestione impropria di dati...

CVE-2024-50849

CVE-2024-50849: XSS Armazenado no WorldServer v11.8.2 Uma vulnerabilidade de Cross-Site Scripting XSS Armazenado na funcionalidade "Regras" do WorldServer v11.8.2 permite que um autenticador remoto execute código JavaScript arbitrário. Um usuário autenticado com altos privilégios deve acessar a...