72710 matches found
CVE-2026-54319
creationtimestamp| type| source ---|---|--- 2026-06-23 20:09:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moy7frrskd24...
CVE-2026-54320
creationtimestamp| type| source ---|---|--- 2026-06-23 20:08:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moy7cs26fp2f...
CGA-2J4G-FWWF-RQRF
Bulletin has no description...
CGA-5JCP-6VM7-7VHG
Bulletin has no description...
Cross-site Scripting (XSS)
Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Cross-site Scripting XSS via the webhookId parameter in the Chat Trigger node. An attacker can execute arbitrary JavaScript in the context of another user's session by injecting malicious code, which is the...
CVE-2026-54019
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI added collection-level ACL checks, but the patch can still be bypassed when Milvus multitenancy mode is enabled. The ACL allows unknown non-KB collection names as...
EUVD-2026-38563
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the targe...
CVE-2026-54322 Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the targe...
CVE-2026-54015 Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI's prompt version-history endpoints authorize the promptid in the URL but then act on caller-supplied history IDs without verifying that the history row belongs to that...
CVE-2026-44274
creationtimestamp| type| source ---|---|--- 2026-06-23 16:26:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116800356044077803...
CVE-2026-48519
Langflow CVE-2026-48519 exposes unauthenticated RCE via the Shareable Playground. Affected: Langflow prior to 1.9.2. Vulnerable route: /api/v1/build_public_tmp permits executing any public flow; payloads can inject arbitrary Python code into data.nodes[X].data.node.template.code.value. Impact is ...
CVE-2026-56695 OpenHarness - Cross-Session Disclosure via /resume and /summary Commands
OpenHarness ohmo gateway /resume and /summary slash commands default remoteinvocable to True, allowing admitted remote senders to enumerate and load arbitrary session snapshots by ID. Attackers can exploit this to access victim snapshots containing private prompts, credentials, tool output, and...
EUVD-2026-38463
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization. Attackers with a valid questionId can approve or reject privileged actions like package installation by submitting approval response...
CVE-2026-56402 NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization. Attackers with a valid questionId can approve or reject privileged actions like package installation by submitting approval response...
CVE-2026-55555
creationtimestamp| type| source ---|---|--- 2026-06-23 14:34:07+00:00| published-proof-of-concept| https://hakaisecurity.io/explorando-geradores-de-pdf-0-days-em-90-milhoes-de-alvos-por-mes/research-blog 2026-06-23 14:34:07+00:00| published-proof-of-concept|...
CVE-2026-56274
creationtimestamp| type| source ---|---|--- 2026-06-23 14:27:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxmasquup2a 2026-06-25 05:40:10+00:00| seen| https://gist.github.com/muhamedfazalps/db2c0e46436e75ee35dd214e14e27b40 2026-07-10 11:37:06+00:00| seen|...
CVE-2026-56225
creationtimestamp| type| source ---|---|--- 2026-06-23 14:19:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxlsg2pk52s...
CVE-2026-56315
creationtimestamp| type| source ---|---|--- 2026-06-23 14:12:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxlh2kytx2w...
CVE-2025-71337
creationtimestamp| type| source ---|---|--- 2026-06-23 14:00:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxks42chc2l 2026-07-10 12:07:10+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqc4e6fhnr2m...