CVE-2026-9225

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...

CVE-2026-76653

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 v2, v3 & v5 and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials...

EUVD-2026-75723

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...

CVE-2026-9225 Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...

CVE-2026-9225 Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...

CVE-2026-9225

IBM Langflow OSS 1.0.0 through 1.11.5 is affected by an authorization bypass (CWE-639) in the File/Read File component. When executing flows via the /api/v1/run/advanced/{flow_id} endpoint, component inputs can reference storage paths using arbitrary user or flow identifiers without verifying own...

CVE-2026-76653 Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 v2, v3 & v5 and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials...

CVE-2026-4129 Improper Access Controls in NI SystemLink

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server versions prior to 2026...

CVE-2026-4129

NI SystemLink and NI SystemLink Server (versions 2026 Q3 and prior) contain an improper access control vulnerability that allows an authenticated user with limited privileges to access host operating system files and directories that should be restricted. The CVSS 3.1 score is 8.1 (HIGH) with hig...

EUVD-2026-75564

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior...

CVE-2026-4129 Improper Access Controls in NI SystemLink

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior...

Security Bulletin: IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

Summary IBM SDK Java Technology Edition and IBM Runtime Environment Java used by IBM i to support the building and running of Java applications are vulnerable to multiple vulnerabilities CVE-2026-16441, CVE-2026-46917, CVE-2026-47063, CVE-2026-60147, CVE-2026-41254, CVE-2026-47057, CVE-2026-47058...

Cognee allows non-superusers to overwrite global LLM configuration

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

PYSEC-2026-3816 Cognee allows non-superusers to overwrite global LLM configuration

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

JetBrains YouTrack < 2025.3.160480 / 2026.1.x < 2026.1.14047 Improper Access Control (CVE-2026-86498)

The version of JetBrains YouTrack installed on the remote host is prior to 2025.3.160480, or 2026.1.x prior to 2026.1.14047. It is, therefore, affected by an improper access control vulnerability: - In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 PUT requests on link sub-resources allowe...

JetBrains TeamCity 2021.2 - 2022.10 Improper Access Control (CVE-2022-44622)

The version of JetBrains TeamCity installed on the remote host is version 2021.2 up to but not including 2022.10. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive CVE-2022-4462...

PT-2026-89460

🚨 CVE-2026-4129 There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q...

PT-2026-89579

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 v2, v3 & v5 and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials...

CVE-2026-76653: Buffer Over-read

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 v2, v3 & v5 and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials...

CVE-2026-4129: Missing Authorization

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior...