34455 matches found
PT-2026-89598
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description An unauthenticated attacker can execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints. This occurs because of improper enforcement of...
CVE-2026-85025: Incorrect Authorization
IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls...
PT-2026-89401
🚨 CVE-2026-88890 OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile. filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root...
JetBrains YouTrack < 2026.1.14047 Multiple Vulnerabilities
The version of JetBrains YouTrack installed on the remote host is prior to 2026.1.14047. It is, therefore, affected by multiple vulnerabilities: - In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...
JetBrains TeamCity 2018.2 - 2019.2.1 Information Disclosure (CVE-2020-11938)
The version of JetBrains TeamCity installed on the remote host is version 2018.2 up to and including 2019.2.1. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project. T...
Joker linter executed project-local .jokerd/linter.* files during linting
Impact In Joker versions before 1.8.2, joker --lint located a .jokerd/ directory by walking up from the linted file and executed matching linter. files from that directory before linting. Because these files are executable Joker/Clojure code, linting a file inside an untrusted repository could...
SUSE CVE-2026-54766
Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/projectduplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project...
SUSE CVE-2026-55064
Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...
PT-2026-89212
Name of the Vulnerable Software and Affected Versions Joker versions prior to 1.8.2 Description When using the joker --lint command, the software searches for a .jokerd/ directory by traversing upwards from the target file and executes any matching linter. files found within that directory. Since...
Spring Office Hours Podcast: S5E22 - Live from KCDC
Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun broadcast live from the Kansas City Developer Conference, one of the largest community driven developer events in the country. Expect conference highlights, hallway track...
CVE-2026-86085
n8n (open-source workflow automation platform) prior to 2.37.7 and 2.38.2 suffered a cross-tenant information disclosure vulnerability in its role assignment endpoints (/rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members). The affected controller (packages/cli/src/c...
CVE-2026-86993
n8n is an open-source workflow automation platform. Prior to 1.123.76 , 2.37.7 , and 2.38.2 , a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check . A user with a custom global role carrying Log Streami...
CVE-2026-86993 n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming...
CVE-2026-86993 n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming...
CVE-2026-86996 n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted...
CVE-2026-81821
The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information...
CVE-2026-79721
MLflow platform (version 0.0.1 or newer ) is vulnerable to arbitrary code execution via a maliciously crafted model artifact . When an end user loads a tampered artifact into a project, it can execute attacker-controlled code on their system. The CNA-assigned CVSS 4.0 score is 8.6 (HIGH) , reflec...
CVE-2026-81821 AVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic key
The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information...
CVE-2026-81821
CVE-2026-81821 affects AVEVA Pipeline Integrity Monitor (PIMBoards) due to the use of a hard-coded cryptographic key . An attacker with local read access to PIMBoards project files can decrypt and view sensitive information stored within them. The CVSS 3.1 score is 8.4 (HIGH) with changed scope, ...
