CVE-2026-51888: Improper Limitation of a Pathname to a Restricted Directory

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

CVE-2026-51886

The langflow-ai langflow application (up to v1.9.3 ) is vulnerable to Authenticated Remote Code Execution (RCE) via a code injection flaw in the validate_code function. The /api/v1/validate/code endpoint uses Python's exec() function to compile and execute user-supplied code for validation. While...

CVE-2026-51886

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...

CVE-2026-51888

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

CVE-2026-51888

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

CVE-2026-51888

The langflow-ai langflow software, specifically versions up to 1.8.4 , is vulnerable to an absolute path traversal vulnerability in the knowledge_bases-create_knowledge_base-a-live-http-post-to-create-knowledge_base endpoint. The root cause is a lack of boundary enforcement in src/backend/base/la...

PT-2026-104044

Name of the Vulnerable Software and Affected Versions langflow-ai langflow versions prior to 1.8.5 Description A directory traversal flaw exists where a public-facing HTTP route handler forwards attacker-controlled paths or filenames into host file creation without boundary enforcement. This allo...

PT-2026-104043

Name of the Vulnerable Software and Affected Versions langflow-ai langflow versions prior to 1.9.4 Description An authenticated attacker can execute arbitrary Python code on the server via a code injection flaw. The issue exists because a public-facing route accepts raw Python source and forwards...

CVE-2026-7192

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

EUVD-2026-88758

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

CVE-2026-7192 Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

CVE-2026-7192 Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

CVE-2026-7192: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

PT-2026-102521

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/do cmd.js’ endpoint containing an excessively long...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the getValidUrl process in the webhook connector, which fails to properly validate hostnames and private IP ranges. An attacker can cause the server to send unauthorized HTTP POST requests to interna...

CVE-2026-100697

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin plugins/drivers/clickhouse.php, rewritten in 6.0.0 is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit authdriver=clickhouse with authserver set to an arbitrary U...

CVE-2026-100697 Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin plugins/drivers/clickhouse.php, rewritten in 6.0.0 is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit authdriver=clickhouse with authserver set to an arbitrary U...

Malicious code in moudeva (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dec843001e36153e09f56c056031d90bf3bcf909a5fe0469f8b27cbed7361c3a The package's main.js references childprocess at multiple locations lines 19, 883, 961 alongside HTTP POST calls lines 365, 369 to a hardcoded endpoi...

CVE-2026-54544

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @loginrequired decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare...

CVE-2026-57139 PraisonAI MCPServer exposes unauthenticated HTTP tools/call

PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest without authentication or authorization. Any network client that can reach the port can...