CVE-2026-6594

creationtimestamp| type| source ---|---|--- 2026-04-20 03:15:41+00:00| published-proof-of-concept| Telegram/53YGjSkDbPEnJFokQd7pok6KqRvuzpfctV8oYeRU736c 2026-04-20 03:58:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjvlcl2uzl2h 2026-04-20 05:35:15+00:00| seen|...

CVE-2026-6598

CVE-2026-6598 affects langflow-ai langflow up to 1.8.3. The vulnerability lies in the function create_project/encrypt_auth_settings (src/backend/base/Langflow/api/v1/projects.py), where manipulation of the auth_settings argument can cause cleartext storage on disk. The issue can be triggered remo...

CVE-2026-6598 langflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file

A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function createproject/encryptauthsettings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such manipulation of the argument authsetting...

CVE-2026-6598 langflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file

A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function createproject/encryptauthsettings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such manipulation of the argument authsetting...

PT-2026-33820

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary JavaScript by manipulating the companyname POST parameter without HTML sanitization. Attackers can...

📄 Remote Sunrise Helper for Windows 2026.14 Directory Creation

Remote Sunrise Helper for Windows version 2026.14 suffers from an unauthenticated directory creation vulnerability. !/usr/bin/env python3 Exploit Title: Remote Sunrise Helper for Windows 2026.14 - Unauthenticated Directory Creation Date: 2026-04-20 Exploit Author: Chokri Hammedi Software:...

ROS-20260420-73-0045

Vulnerability in incus related to failure to take measures to neutralize special elements in the template creation mechanism. Exploitation of the vulnerability may allow an attacker to execute arbitrary code...

PT-2026-33822

GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT Report::Create without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title field when creating or editing a...

PT-2026-33704

Name of the Vulnerable Software and Affected Versions langflow-ai langflow versions prior to 1.8.4 Description An issue exists in the Project Creation Endpoint where manipulation of the auth settings argument in the encrypt auth settings function within the...

CVE-2026-6577

creationtimestamp| type| source ---|---|--- 2026-04-19 21:15:12+00:00| published-proof-of-concept| Telegram/ufJM6PGgYCZvMYI9YNw2SbGN8uW-GB10f-lGfe46lAW4 2026-04-19 21:29:13+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mjuvjsryko2e 2026-04-19 23:53:28+00:00| seen|...

CVE-2026-32958

creationtimestamp| type| source ---|---|--- 2026-04-19 19:30:00+00:00| seen| https://jvn.jp/en/vu/JVNVU94271449 2026-04-21 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-10...

CVE-2026-32963

creationtimestamp| type| source ---|---|--- 2026-04-19 19:30:00+00:00| seen| https://jvn.jp/en/vu/JVNVU94271449 2026-04-21 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-10...

CVE-2024-2035

creationtimestamp| type| source ---|---|--- 2026-04-19 17:02:53+00:00| seen| MISP/19631610-dc3d-4a96-a673-e19bafaf9b91...

CVE-2026-6574

creationtimestamp| type| source ---|---|--- 2026-04-19 15:00:14+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mju7sa6ety2v 2026-04-19 15:00:15+00:00| seen| https://infosec.exchange/users/offseq/statuses/116431966121032331 2026-04-19 15:15:14+00:00| seen|...

CVE-2026-6571

creationtimestamp| type| source ---|---|--- 2026-04-19 13:57:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mju4csc5qz2t...

CVE-2026-6569

creationtimestamp| type| source ---|---|--- 2026-04-19 12:45:12+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mjtyaskb5q23 2026-04-19 13:15:22+00:00| seen| Telegram/YgXeijrZB5WsTpBElNL5GhGy2ztSUOfDhY0-ECDYQWHxtTM 2026-04-19 13:52:54+00:00| seen|...

GHSA-W8J3-QVC3-H56F

creationtimestamp| type| source ---|---|--- 2026-04-19 07:22:56+00:00| seen| https://bsky.app/profile/azu.bsky.social/post/3mjtgake2o22p...

PT-2026-33640

Name of the Vulnerable Software and Affected Versions mailcow: dockerized versions prior to 2026-03b Description A second-order SQL injection exists in the Mailcow API. The endpoint '/api/v1/add/mailbox' stores the quarantine category variable without proper validation or sanitization. This value...

PT-2026-33833

Name of the Vulnerable Software and Affected Versions Rclone versions 1.48.0 through 1.73.4 Description The RC endpoint "operations/fsinfo" is exposed without authentication and accepts attacker-controlled fs input. Since the rc.GetFs function supports inline backend definitions, an unauthenticat...

CVE-2025-68001

creationtimestamp| type| source ---|---|--- 2026-04-18 23:00:13+00:00| published-proof-of-concept| Telegram/J1TSaArQ0ScFY239N-pEajUhnEKmxSQcewj6uEimw6KDWT0 2026-04-19 03:00:05+00:00| published-proof-of-concept| Telegram/fUN7x3zhWJI41Y9qvAix9-DSuCPZFxW-u6Jn34L6Wbqg7U...