CVE-2026-87722

Uncontrolled Resource Consumption CWE-400 / CWE-1333 in regex search query predicates such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate, and sibling predicates and REST regex filter endpoints RegexListSearcher /projects/?r= and RefFilter /projects/project/branches/?r= in Gerrit...

brad-agent (>=0.1.33, <=0.1.34) potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (0.1.1)

langchain-nvidia-ai-endpoints PYPI version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - brad-agent =0.1.33, =0.1.34 Source cves: unknown CVE Source advisory: OSV:GHSA-G28H-2CMM-RJ9X...

aiqtoolkit-langchain (>=1.1.0a20250429, <=1.2.0rc4), gfmrag (>=0.1.3, <=1.0.0) +9 more potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (0.3.19)

langchain-nvidia-ai-endpoints PYPI version 0.3.19 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - aiqtoolkit-langchain =1.1.0a20250429, =0.1.3, =0.1.0, =0.1.1, =1.0.0, =0.5.15, =0.1.7, =24.12.0.dev1,...

aiagents4pharma (>=0.0.0, <=1.49.1), aiagents4pharma-ansh (0.0.0) +2 more potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (0.3.9)

langchain-nvidia-ai-endpoints PYPI version 0.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - aiagents4pharma =0.0.0, =1.49.1 - aiagents4pharma-ansh 0.0.0 - aiagents4pharma-anshh 0.0.0 -...

vss-ctx-rag (>=0.5.0, <=0.5.1) potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (0.3.7)

langchain-nvidia-ai-endpoints PYPI version 0.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - vss-ctx-rag =0.5.0, =0.5.1 Source cves: unknown CVE Source advisory: OSV:GHSA-G28H-2CMM-RJ9X...

mindsdb (>=25.3.4.1, <=25.9.3rc1) potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (0.3.3)

langchain-nvidia-ai-endpoints PYPI version 0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - mindsdb =25.3.4.1, =25.9.3rc1 Source cves: unknown CVE Source advisory: OSV:GHSA-G28H-2CMM-RJ9X...

llm-checks-common-functions (>=1.0.0, <=1.1.0) potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (0.2.2)

langchain-nvidia-ai-endpoints PYPI version 0.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - llm-checks-common-functions =1.0.0, =1.1.0 Source cves: unknown CVE Source advisory:...

nvidia-nat-langchain (>=1.4.0a20260103, <=1.5.0a20260122), nvidia-pipecat (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (1.0.4)

langchain-nvidia-ai-endpoints PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - nvidia-nat-langchain =1.4.0a20260103, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory:...

nvidia-nat-langchain (>=1.4.0a20260103, <=1.5.0a20260122), nvidia-pipecat (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (1.0.4)

langchain-nvidia-ai-endpoints PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - nvidia-nat-langchain =1.4.0a20260103, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory:...

GHSA-G28H-2CMM-RJ9X langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs

Summary langchain-nvidia-ai-endpoints versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model VLM requests. If an application passed attacker-controlled image input to ChatNVIDIA or VLM reranking APIs, an attacker could cause files readable by the applicati...

langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs

Summary langchain-nvidia-ai-endpoints versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model VLM requests. If an application passed attacker-controlled image input to ChatNVIDIA or VLM reranking APIs, an attacker could cause files readable by the applicati...

PT-2026-105510

Summary langchain-nvidia-ai-endpoints versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model VLM requests. If an application passed attacker-controlled image input to ChatNVIDIA or VLM reranking APIs, an attacker could cause files readable by the applicati...

CVE-2026-66074

A Regular Expression Denial of Service (ReDoS) vulnerability exists in RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 . The flaw occurs because the match_value/3 function passes a user-supplied ?name= regular expression to re:run without a match_limit option, executing it on...

EUVD-2026-85558

Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products action. All other administrative AJAX endpoints orders, coupons, media,...

EUVD-2026-42932

9router /v1 APIs has unauthenticated access via reverse proxy locality collapse...

CVE-2026-76183 Apache Tomcat: Bypass of security constraints for WebSocket endpoints

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following version...

CVE-2026-63445

A flaw was found in Perses, an open-source dashboard and visualization project. An authenticated attacker can exploit a vulnerability in list endpoints that use the file-system database. By manipulating the project query parameter with directory traversal characters, an attacker can read arbitrar...

CVE-2026-89331 FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators...

CVE-2026-89331 FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators...

CVE-2026-77766: Authorization Bypass Through User-Controlled Key

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to...