Security Bulletin: Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Summary Langflow provides a visual interface for constructing and executing AI-powered agent workflows, exposing HTTP API endpoints for flow execution, file management, vector store operations, and Model Context Protocol MCP server configuration. An attacker could exploit insufficient validation...

CVE-2026-10276 hekmon8 Jenkins-server-mcp get_build_status/get_build_log/trigger_build index.ts jobPath server-side request forgery

A vulnerability has been found in hekmon8 Jenkins-server-mcp 0.1.0. This vulnerability affects the function jobPath of the file src/index.ts of the component getbuildstatus/getbuildlog/triggerbuild. Such manipulation leads to server-side request forgery. The attack may be performed from remote. T...

EUVD-2012-1131

Malware in sbrugna...

EUVD-2022-5244

Malicious code in bioql PyPI...

EUVD-2022-6582

Malicious code in bioql PyPI...

EUVD-2023-41891

Malicious code in bioql PyPI...

EUVD-2025-20864

Malicious code in bioql PyPI...

EUVD-2023-1395

Malicious code in bioql PyPI...

EUVD-2024-39204

Malicious code in bioql PyPI...

EUVD-2024-2206

Malicious code in bioql PyPI...

EUVD-2023-1276

Malicious code in bioql PyPI...

EUVD-2023-1623

Malicious code in bioql PyPI...

EUVD-2022-5656

Malicious code in bioql PyPI...

EUVD-2025-20863

Malicious code in bioql PyPI...

EUVD-2022-7767

Malicious code in bioql PyPI...

EUVD-2025-8293

Malicious code in bioql PyPI...

EUVD-2023-2118

Malicious code in bioql PyPI...

EUVD-2023-1311

Malicious code in bioql PyPI...

CVE-2025-53651

Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTML reports post-build step, exposing information about the Jenkins controller file system in the build log...

Jenkins plugins Multiple Vulnerabilities (2025-07-09)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller,...