Lucene search
+L

37406 matches found

IBM Security Bulletins
IBM Security Bulletins
added 2026/08/24 3:13 p.m.34 views

Security Bulletin: Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Summary Langflow OSS supports Agentic Assistant generated components and user-supplied custom Python components for workflow development. Weaknesses in code security scanning, runtime validation, custom component execution paths, and trusted code enforcement could allow authenticated users to...

8.8CVSS6.8AI score0.00449EPSS
SaveExploits0Affected Software1
NVD
NVD
added 2026/08/24 1:17 p.m.7 views

CVE-2026-21756

HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments...

7.2CVSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/24 12:51 p.m.8 views

EUVD-2026-64840

HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments...

7.2CVSS5.5AI score
SaveExploits0References1
CVE
CVE
added 2026/08/24 12:51 p.m.8 views

CVE-2026-21756

HCL Hive is affected by a broken access control vulnerability that could allow an authenticated or unauthorized user to introduce unverified, malicious, or broken code directly into production environments . The CVSS 3.1 score is 7.2 (HIGH) , with a vector requiring high privileges (PR:H), networ...

7.2CVSS5.3AI score
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/24 12:51 p.m.17 views

CVE-2026-21756 HCL Hive is affected by a broken access control vulnerability

HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments...

7.2CVSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.109 views

MetInfo CMS <= 8.1 - Remote Code Execution

MetInfo CMS 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability caused by insufficient input neutralization in the execution path, letting remote attackers execute arbitrary code remotely, exploit requires crafted requests. id: CVE-2026-29014 info: name: MetInfo CMS = 8....

9.8CVSS9.7AI score0.3949EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.36 views

Netsweeper 4.0.3 - Cross-Site Scripting

A cross-site scripting vulnerability in webadmin/policy/grouptableajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO. id: CVE-2014-9608 info: name: Netsweeper 4.0.3 - Cross-Site Scriptin...

6.1CVSS6AI score0.04663EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.40 views

TP-Link Archer A20 v3 Router - Cross-site Scripting

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

4.8CVSS8.3AI score0.00892EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.37 views

Google ADK-Python - Unauthenticated Builder Endpoint

Google Agent Development Kit ADK 1.7.0 through 1.28.1 and 2.0.0a1 through 2.0.0a2 on Python OSS, Cloud Run, and GKE contains a code injection and missing authentication vulnerability, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no authentication...

10CVSS5.9AI score0.01818EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.197 views

ISPConfig - PHP Code Injection

An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if adminallowlangedit is enabled. id: CVE-2023-46818 info: name: ISPConfig - PHP Code Injection author: non-things severity: high description: | An issue was discovered...

7.2CVSS7.1AI score0.15856EPSS
SaveExploits14References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.71 views

Microweber <1.3.2 - Cross-Site Scripting

Code Injection in on search.php?keywords= GitHub repository microweber/microweber prior to 1.3.2. id: CVE-2022-3242 info: name: Microweber 1.3.2 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | Code Injection in on search.php?keywords= GitHub repository microweber/microweber...

6.1CVSS4.9AI score0.01437EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.154 views

Citrix ADC and Citrix NetScaler Gateway - Remote Code Injection

Citrix ADC and NetScaler Gateway are susceptible to remote code injection. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are before 13.0-58.30,...

6.5CVSS7.3AI score0.10695EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.193 views

Ivanti EPM Cloud Services Appliance Code Injection

Ivanti EPM Cloud Services Appliance CSA before version 4.6.0-512 is susceptible to a code injection vulnerability because it allows an unauthenticated user to execute arbitrary code with limited permissions nobody. id: CVE-2021-44529 info: name: Ivanti EPM Cloud Services Appliance Code Injection...

9.8CVSS9.3AI score0.99105EPSS
SaveExploits9References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.21 views

MediaWiki EasyTimeline - Code Injection RCE

MediaWiki EasyTimeline Timeline extension versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 contain a code injection vulnerability caused by insufficient neutralization of newlines in TextData text attributes in EasyTimeline.pl / Timeline.php. A crafted block can inject ploticus 'proc getdata' a...

8.8CVSS5.5AI score0.02098EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.12 views

GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

9.4CVSS8.9AI score0.06001EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.111 views

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...

10CVSS8.6AI score0.98253EPSS
SaveExploits54References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.11 views

Sneeit WP Social WordPress Plugin - Unauthenticated RCE via call_user_func

The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeitarticlespaginationcallback function. This is due to the function accepting user input and then passing that through calluserfunc. This makes it possible for...

9.8CVSS8.1AI score0.76138EPSS
SaveExploits3References5
NVD
NVD
added 2026/08/24 2:17 a.m.12 views

CVE-2026-78166

A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in cod...

6.5CVSS0.00305EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/08/24 1:00 a.m.7 views

EUVD-2026-64686

A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in cod...

6.5CVSS6.4AI score0.00305EPSS
SaveExploits0References6
CVE
CVE
added 2026/08/24 1:00 a.m.21 views

CVE-2026-78166

A code injection vulnerability was identified in provectus kafka-ui (up to 0.7.2), affecting the Groovy Code Handler component. Specifically, the executeSmartFilterTest function in MessagesController.java can be exploited remotely to inject and execute arbitrary code. The exploit has been release...

6.5CVSS6.3AI score0.00305EPSS
SaveExploits0References6
Rows per page
Query Builder