GHSA-CF6M-VC3M-7CGM Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass

Summary A vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False. This allows a remote attacker who knows a flow's UUID ...

Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass

Summary A vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False. This allows a remote attacker who knows a flow's UUID ...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-40860

camel-jms JMS ObjectMessage Unsafe Deserialization Reproducer CVE-2026-40860 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-jms component and, transitively, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, camel-activemq6, tracked as CVE-2026-40860...

Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

copy-fail-mcp

Copy Fail MCP 📖 Installation Guide — quick start, manual setup, and troubleshooting CVE-2026-31431 — The worst Linux vulnerability ever discovered. Now controllable via MCP. 732 bytes of Python. No compilation. No race condition. No per-distro offsets. One shot, universal root on every Linux kern...

keycloak__keycloak_CVE-2014-3656_1-0-5-Final

Open Source Identity and Access Management Add authentication to applications and secure services with minimum effort. No need to deal with storing users or authenticating users. Keycloak provides user federation, strong authentication, user management, fine-grained authorization, and more. Help...

CVE-2024-51482

CVE-2024-51482 - Inyección SQL Ciega en ZoneMinder Tabla de Contenidos Resumen Detalles de la Vulnerabilidad Análisis Técnico Guía de Explotación Instalación Ejemplos de Uso Mitigación Referencias Resumen CVE-2024-51482 es una vulnerabilidad crítica de inyección SQL de tipo booleano ciego...

CVE-2026-43866

camel-jms Forged DefaultExchangeHolder Filter-Bypass Reproducer CVE-2026-43866 This project demonstrates CVE-2026-43866 , a bypass of the CVE-2026-40860 fix in Apache Camel's camel-jms and camel-sjms / JMS-family components. CVE-2026-40860 added a post-deserialization class allow-list...

Security Bulletin: Due to the use of Spring Expression Language (SpEL), IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-47886)

Summary Spring Expression Language SpEL is used by IBM Sterling Control Center as part of dependency in spring-expression-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47886 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a...

bugbounty-lab101

██████╗ ███████╗██╗ ██╗ ██╗ ██████╗ ██╗██╗ ██╗ ██╔══██╗██╔════╝██║ ██║███║██╔═████╗███║╚██╗██╔╝ ██║ ██║█████╗ ██║ ██║╚██║██║██╔██║╚██║ ╚███╔╝ ██║ ██║██╔══╝ ╚██╗ ██╔╝ ██║████╔╝██║ ██║ ██╔██╗ ██████╔╝███████╗ ╚████╔╝ ██║╚██████╔╝ ██║██╔╝ ██╗ ╚═════╝ ╚══════╝ ╚═══╝ ╚═╝ ╚═════╝ ╚═╝╚═╝ ╚═╝ BUG BOUNTY...

Important: Red Hat Security Advisory: Red Hat build of Kueue 1.4.3 release

Red Hat build of Kueue 1.4.3 release The Red Hat build of Kueue is an optional operator, based on Kueue upstream, to enable the installation of Kueue on Openshift. Kueue is a queueing framework for managing Kubernetes workloads. This release is based on Kueue v0.18.11...

cve-2025-11142-axis-mediaclip-rce

CVE-2025-11142 — AXIS mediaclip.cgi OS Command Injection n-day research writeup & PoC — post-patch technical analysis of a CVSS 7.1 OS command injection vulnerability in the AXIS VAPIX Media Clip API, independently rediscovered and verified through black-box testing against an Axis device. Axis's...

Open-Source-Threat-Intel-Feeds

Free Threat Intel/IOC Feeds This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. The CSV ThreatIntelFeeds is stored in a structured manner based on the Vendor, Description, Category and URL. The vendors offering ThreatIntelFeeds a...

CVE-2026-101919

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

BlackSnufkin

🎯 Profile Overview You have finally discovered my Github profile. Please feel free to clone/fork projects, raise issues and submit PRs if you think something could be better. Read my blog for write-ups and research - Happy Hacking! 😊 struct OffensiveOperator handle: String, role: String,...

CVE-2023-21716

CVE-2023-21716 Microsoft Word RTF Font Table Heap Corruption https://twitter.com/jduck A vulnerability within Microsoft Office's wwlib allows attackers to achieve remote code execution with the privileges of the victim that opens a malicious RTF document. The attacker could deliver this file as a...

CVE-2026-101919

A vulnerability exists in the HyperShift operator where it copies user-provided kubeconfig secrets directly into the privileged control plane namespace without sufficient validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this by supplying a...