172665 matches found
CVE-2026-75792 IBM Sterling Secure Proxy is vulnerable to multiple issues
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass...
CVE-2026-78415 IBM Sterling Secure Proxy is vulnerable to multiple issues
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutralization of user-supplied HTML markup...
EUVD-2026-78139
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutralization of user-supplied HTML markup...
CVE-2026-78415 IBM Sterling Secure Proxy is vulnerable to multiple issues
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutralization of user-supplied HTML markup...
CVE-2026-78415
IBM Sterling Secure Proxy versions 6.2.0.0 through 6.2.1.2 are affected by a vulnerability where improper neutralization of user-supplied HTML markup (CWE-79) allows a remote authenticated attacker to perform UI spoofing and phishing attacks . The attack requires low privileges and low complexity...
CVE-2026-68489
CVE-2026-68489 is a Static Code Injection vulnerability in two Plesk extensions: Ruby (before 1.6.6) and Node.js Toolkit (before 2.5.0). A remote authenticated user can execute arbitrary code as root by crafting malicious custom environment variables . The vulnerability scores 8.7 (HIGH) under CV...
CVE-2026-68489
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...
CVE-2026-68489
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...
EUVD-2026-78087
IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component...
CVE-2026-12763
IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component...
EUVD-2026-78084
IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...
CVE-2026-12766
IBM Langflow OSS (versions 1.0.0–1.11.2) is vulnerable to Server-Side Request Forgery (SSRF) across multiple components. The root cause involves missing or bypassable URL validation: the LMStudio and embeddings components pass a user-controlled base_url to httpx.AsyncClient without invoking the S...
CVE-2026-12766 Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...
CVE-2026-12766 Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...
CVE-2026-17628
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication...
CVE-2026-16702
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference...
CVE-2026-17463
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption...
CVE-2026-16673
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property...