9993 matches found
Security Bulletin: Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
Summary Langflow OSS supports Agentic Assistant generated components and user-supplied custom Python components for workflow development. Weaknesses in code security scanning, runtime validation, custom component execution paths, and trusted code enforcement could allow authenticated users to...
Exploit for Deserialization of Untrusted Data in Facebook React
Next.js React Server Components RCE Exploit Exploits CVE-2025...
Malicious Package
Overview @immuta/pxl-components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...
PT-2026-80903
HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws...
CVE-2026-21752: Use of Unmaintained Third Party Components
HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws...
CVE-2026-12554: Use of Unmaintained Third Party Components
Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities...
CVE-2026-78180: Improperly Controlled Modification of Object Prototype Attributes
A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal through the restore path handling in lib/backup/actions/restore.go, lib/backup/common/part.go, and lib/backup/fslocal/fslocal.go. An attacker can write or overwrite files outside the configured -storageDataPath by...
agent-scan v0.6.0
Snyk Agent Scan Discover and scan agent components on your machine for prompt injections and vulnerabilities including agents, MCP servers, skills. Note: CLI output is experimental and subject to change Agent Scan v0.5.x planned for deprecation The raw output of this CLI — including issue codes,...
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' through the composition lookup. An attacker can manipulate the base function by injecting malicious components during the lookup process,...
CVE-2026-70890
creationtimestamp| type| source ---|---|--- 2026-08-19 17:45:16+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-61228
creationtimestamp| type| source ---|---|--- 2026-08-19 17:19:18+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-27 21:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu3qvy57rv2f...
CVE-2026-53785
A path traversal vulnerability in rsync's --relative mode allows a malicious sender to craft symlink paths, enabling arbitrary file writes outside the destination directory. Mitigation To mitigate this issue, avoid using the rsync --relative -R option when synchronizing with untrusted senders...
EUVD-2026-61374
Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite component: Common Components. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
EUVD-2026-61288
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: WLS Core Components. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromis...
PT-2026-77444
Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 Description An issue in the WLS Core Components of Oracle Fusion Middleware allows an unauthenticated attacker with network access via RMI Remote Method Invocation, a Java A...
PT-2026-77530
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Financials Common Modules versions 12.2.3 through 12.2.15 Description A flaw in the Common Components component allows a low privileged attacker with network access via HTTP to compromise the system. This issue c...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101973)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101973 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser rsahelper.c bounds ea...
CVE-2026-47699: Improper Limitation of a Pathname to a Restricted Directory
Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make imagers::stream::unpack::unpack create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs,...
CVE-2026-61331: Improper Access Control
Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite component: Common Components. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...