CVE-2026-9201

IBM Langflow OSS 1.0.0–1.10.3 is affected by an authenticated arbitrary code execution vulnerability in the custom component validation mechanism. The hardening mode that restricts execution to trusted templates validates component code using a truncated SHA-256 digest, causing only a portion of ...

CVE-2026-8478 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code...

CVE-2026-8478

The CVE-2026-8478 entry describes a remote arbitrary code execution in IBM Langflow OSS 1.0.0–1.10.3 due to improper control of user input code in component generation, validation, and custom component handling. The vulnerability could allow an attacker to inject code on the system; CVSSv3.1 yiel...

CVE-2026-10128

IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environment variables, exposing sensitive secrets despite security controls intended to disable custom components...

CVE-2026-71259

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

Astra Linux – Vulnerability in Firefox

DOM spoofing issue: Core & HTML components. This vulnerability has been fixed in Firefox 152 and Thunderbird 152...

CVE-2026-71259 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

CVE-2026-71259 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

CVE-2026-71259

ESPHome (up to 2026.7.0-dev) is affected by an operator-precedence bug in the cv.url() validator within esphome/config_validation.py. The condition if parsed.scheme and parsed.netloc or parsed.scheme == "file" incorrectly permits file:// URIs to bypass validation, affecting the url: field of the ...

CVE-2026-71259 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

EUVD-2026-53344

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py: if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl. Because and binds tighter than or, any file: URI passes validation regardless of netloc. Th...

MAL-2026-12223 Malicious code in tailwindcss-form-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae9425c630e8b36b03993f6124066f178a86a285ae44e5e4590016ac575c4cac index.js exposes getPlugin, which performs an HTTP GET to http://46.183.25.232:45000/icons/106, parses the JSON response, and passes the credits fiel...

Malicious code in tailwindcss-form-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae9425c630e8b36b03993f6124066f178a86a285ae44e5e4590016ac575c4cac index.js exposes getPlugin, which performs an HTTP GET to http://46.183.25.232:45000/icons/106, parses the JSON response, and passes the credits fiel...

MAL-2026-12042 Malicious code in platform-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare...

The vulnerability of the DOM components in Google Chrome and Microsoft Edge web browsers allows a hacker to induce a service failure.

The vulnerability of the DOM components in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

Release Information for Veeam Recovery Orchestrator 13 and Updates

Veeam Recovery Orchestrator 13 Releases 13.1.0.483 2026-07-29 Embedded component versions: Veeam Backup & Replication 13.1.0.411, Veeam ONE 13.1.0.7034 Release Notes What's New 13.0.3.26 2026-08-28 Embedded component versions: Veeam Backup & Replication 13.0.3.63, Veeam ONE 13.0.2.7159 Release...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via the run method in the CSVAgents class. An attacker can execute arbitrary code in the context of the server process by sending crafted prompts to a chatflow using...

Eval Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Eval Injection via the CSVAgent process. An attacker can execute arbitrary code on the host system by injecting malicious input into the csvFile parameter, which is interpolated directly into...

Incomplete List of Disallowed Inputs

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the validatePythonCodeForDataFrame process. An attacker can execute arbitrary operating system commands by submitting specially crafted Python code...

Incomplete List of Disallowed Inputs

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the validatePythonCodeForDataFrame process. An attacker can execute arbitrary operating system commands by submitting specially crafted Python code...