CVE-2026-97680

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem...

CVE-2026-97680

IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by a vulnerability (CVE-2026-97680 ) caused by improper access control in the vertex result caching subsystem . This flaw could allow a remote authenticated attacker to obtain sensitive information or inject malicious data . To remediate...

CVE-2026-97680 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem...

CVE-2026-97680 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem...

Incorrect Authorization

Overview org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Incorrect Authorization via the Modify Data Streams API. An attacker can alter or inject data into data streams they are not authorized to access by exploiting...

CLEANSTART-2026-IC49054 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

Security vulnerability affects the temporal-server package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

PT-2026-107334

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Improper access control in the vertex result caching subsystem allows a remote authenticated attacker to obtain sensitive information or inject malicious data. Recommendations Update I...

EUVD-2026-86347

PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters...

Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

Summary The POST handler for /realtime/v1/streams/:runId/:streamId has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream. Vulnerability Details File: apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts The action...

NPM: Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

NPM: Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.4...

GHSA-59H8-W5Q6-MFMP Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

Summary The POST handler for /realtime/v1/streams/:runId/:streamId has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream. Vulnerability Details File: apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts The action...

PT-2026-111184

Summary The POST handler for /realtime/v1/streams/:runId/:streamId has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream. Vulnerability Details File: apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts The action...

Rocky Linux 10.1 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc (crlsa-2026_4705)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20264705 advisory. nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections CVE-2026-1642 Tenable has extracted the preceding description block directly...

AlmaLinux 9.2 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1764084458)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764084458 advisory. - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data...

Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc (crlsa-2026_4235)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20264235 advisory. nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections CVE-2026-1642 Tenable has extracted the preceding description block directly fr...

CentOS Linux 6 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-libs / bind-sdb / bind-utils (CENTOS6:CLSA-2026:1781169600)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1781169600 advisory. - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache...

Rocky Linux 8 [CIQ] Security Update: nginx / nginx-all-modules / nginx-debuginfo / nginx-debugsource / etc (crlsa-2026_5581)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20265581 advisory. nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections CVE-2026-1642 Tenable has extracted the preceding description block directly fr...

Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc (crlsa-2026_3638)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20263638 advisory. nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections CVE-2026-1642 Tenable has extracted the preceding description block directly fr...

CentOS Linux 7 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-devel / etc (CENTOS7:CLSA-2026:1789729116)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1789729116 advisory. - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with ...

CLSA-2026-1789729568 nginx: Fix of 2 CVEs

CVE-2026-1642: reject a plain text response read from an SSL-enabled upstream before the TLS handshake has started, preventing data injection by a man-in-the-middle on the upstream connection...