CVE-2026-110196

IBM Langflow OSS versions 1.0.0 through 1.12.4 are affected by a vulnerability where a remote attacker with a low-privileged authenticated account can bypass administrator-only restrictions. By providing attacker-supplied inputs to a built-in code-execution component, the attacker can execute arb...

Nextcloud Collabora Online Built-in CODE Server 26.4.302 Command Injection Exposure Checker

The Collabora Online Built-in CODE Server richdocumentscode app for Nextcloud before version 26.4.303 contains an unauthenticated OS command injection vulnerability in proxy.php. This tool passively checks a supplied Nextcloud instance for public exposure indicators...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: tick/nohz: unexport init-annotated ticknohzfullsetup EXPORTSYMBOL and init are a bad combination because the .init.text section is freed after initialization. As a result, modules cannot use symbols annotated init. Accessing a...

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an...

CVE-2026-110447

Collabora Online Built-in CODE Server before 26.4.303 richdocumentscode, a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't...

CVE-2026-110447

Collabora Online Built-in CODE Server before 26.4.303 richdocumentscode, a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't...

CVE-2026-110447

The Collabora Online Built-in CODE Server (Nextcloud app richdocumentscode ) is vulnerable to remote code execution (RCE) via an OS command injection in the proxy.php script. The flaw occurs specifically when the CODE server is not running, such as immediately after a restart, crash, or upgrade. ...

EUVD-2026-100780

Collabora Online Built-in CODE Server before 26.4.303 richdocumentscode, a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't...

CVE-2026-110447

Collabora Online Built-in CODE Server before 26.4.303 richdocumentscode, a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't...

CVE-2026-110447: Improper Neutralization of Special Elements used in an OS Command

Collabora Online Built-in CODE Server before 26.4.303 richdocumentscode, a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't...

VulnCheck KEV: CVE-2026-110447

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running...

PT-2026-113607

Name of the Vulnerable Software and Affected Versions Collabora Online Built-in CODE Server richdocumentscode versions prior to 26.4.303 Description An OS command injection exists in the proxy.php file of the Collabora Online Built-in CODE Server for Nextcloud. This flaw allows unauthenticated...

PT-2026-96780

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.0 Description The Mach-O LC DATA IN CODE parser trusts dataoff and datasize and allows a final partial record to be processed. When datasize is not a multiple of data in code entry, the last iteration reads beyond...

CVE-2026-92965

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code...

CVE-2026-92965

The TikTok WordPress plugin versions 1.2.0 through 1.4.1 is vulnerable to unauthenticated OAuth code redemption . The root cause is a failure to verify request authorization when processing a sign-in code provided in the URL. This allows any visitor to force the site to redeem an arbitrary code a...

CVE-2026-92965 TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code...

EUVD-2026-83679

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code...

PT-2026-95932

Name of the Vulnerable Software and Affected Versions TikTok WordPress plugin versions prior to 1.4.2 Description An issue exists where the plugin fails to verify if a request is authorized before processing a sign-in code provided in the URL. This allows any visitor to force the site to redeem a...

CVE-2026-92965: Missing Authorization

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code...

EUVD-2026-45089

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.0.0 and above, prior to 4.14.5, a sizet integer underflow in oscrypto/shared/msgs.c:389 allows any enrolled Wazuh agent to crash the wazuh-remoted process on the manager, immediately...