Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass

Summary A vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False. This allows a remote attacker who knows a flow's UUID ...

CVE-2026-34048

CVE-2026-34048 Admin-only terminal bootstrap routes checked only for login state, which let a normal team member drive Coolify's realtime terminal backend and execute commands on team servers. Intro I found this issue while reviewing Coolify , an open-source self-hosted PaaS, with a very direct...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-40860

camel-jms JMS ObjectMessage Unsafe Deserialization Reproducer CVE-2026-40860 Этот проект демонстрирует уязвимость десериализации Java в компоненте camel-jms Apache Camel и, транзитивно, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, camel-activemq6, отслеживаемую как CVE-2026-40860...

Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

keycloak__keycloak_CVE-2014-3656_1-0-5-Final

Открытая система управления идентификацией и доступом Добавляйте аутентификацию в приложения и защищайте сервисы с минимальными усилиями. Не нужно заниматься хранением пользователей или их аутентификацией. Keycloak предоставляет федерацию пользователей, строгую аутентификацию, управление...

CVE-2024-51482

CVE-2024-51482 - Injection SQL aveugle dans ZoneMinder Table des matières Aperçu Détails de la vulnérabilité Analyse technique Guide d'exploitation Installation Exemples d'utilisation Atténuation Références Aperçu CVE-2024-51482 est une vulnérabilité critique d'injection SQL booléenne découverte...

CVE-2026-43866

camel-jms Воспроизводитель обхода фильтра поддельного DefaultExchangeHolder CVE-2026-43866 Этот проект демонстрирует CVE-2026-43866 , обход исправления CVE-2026-40860 в компонентах camel-jms и camel-sjms / семейства JMS Apache Camel. CVE-2026-40860 добавил белый список классов после десериализаци...

Security Bulletin: Due to the use of Spring Expression Language (SpEL), IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-47886)

Summary Spring Expression Language SpEL is used by IBM Sterling Control Center as part of dependency in spring-expression-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47886 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a...

CVE-2026-6307

CVE-2026-6307: V8 JS-to-Wasm type confusion → RCE on Chrome 146 Local reproduction and weaponization of the V8 JS-to-Wasm deoptimization type confusion described by Nebula, taken to a xcalc popped from the renderer of Chrome for Testing 146.0.7680.165 the bug is fixed in 147.0.7727.101. All...

Important: Red Hat Security Advisory: Red Hat build of Kueue 1.4.3 release

Red Hat build of Kueue 1.4.3 release The Red Hat build of Kueue is an optional operator, based on Kueue upstream, to enable the installation of Kueue on Openshift. Kueue is a queueing framework for managing Kubernetes workloads. This release is based on Kueue v0.18.11...

CVE-2026-101919

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

BlackSnufkin

🎯 Обзор профиля Вы наконец-то нашли мой профиль на Github. Пожалуйста, смело клонируйте/форкайте проекты, открывайте issues и отправляйте PR, если считаете, что что-то можно улучшить. Читайте мой блог для разборов и исследований — Счастливого хакинга! 😊 struct OffensiveOperator handle: String,...

CVE-2023-21716

CVE-2023-21716 Повреждение кучи таблицы шрифтов RTF в Microsoft Word https://twitter.com/jduck Уязвимость в wwlib из Microsoft Office позволяет злоумышленникам добиться удаленного выполнения кода с привилегиями жертвы, которая открывает вредоносный RTF-документ. Злоумышленник может доставить этот...

CVE-2026-101919 Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

EUVD-2026-92524

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

CVE-2026-101919 Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

CVE-2026-101919

A vulnerability exists in the HyperShift operator where it copies user-provided kubeconfig secrets directly into the privileged control plane namespace without sufficient validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this by supplying a...