EUVD-2026-53618

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-70612

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

NPM: Electron: Sandboxed iframes can launch external protocol handlers

NPM: Electron: Sandboxed iframes can launch external protocol handlers vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

Electron: Sandboxed iframes can launch external protocol handlers

Impact Requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame's sandbox state was also not made available to the app's permission handlers. Ap...

CVE-2026-70612 Electron: Sandboxed iframes can launch external protocol handlers

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

CVE-2026-70612 Electron: Sandboxed iframes can launch external protocol handlers

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

CVE-2026-70612

The vulnerability CVE-2026-70612 affects Electron. It occurs when web content in sandboxed iframes can trigger external protocol handlers, because iframe sandbox restrictions were not applied to openExternal requests and the frame state wasn’t exposed to permission handlers. This could allow an O...

CVE-2026-17625 Langflow is affected by OS Command Injection in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special element...

CVE-2026-17625

Langflow OSS versions 1.0.0–1.10.3 are affected by an OS Command Injection in Model Context Protocol features (MCP). The IBM bulletin describes weaknesses in MCP validation, authentication/authorization enforcement, and request handling that could allow a remote authenticated attacker to execute ...

CVE-2026-8446

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol MCP composer endpoint when mcpcomposerenabled=true default and projects are configured with authtype=oauth...

CVE-2026-20301

A vulnerability in the Extensible Messaging Client Protocol XMCP, also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability ...

CVE-2026-20263

A vulnerability in the Blocks Extensible Exchange Protocol BEEP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling when parsing a specific BEEP SOAP...

CVE-2026-20124

A vulnerability in the Simple Network Management Protocol SNMP subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload, resulting in a denial of service DoS condition. This vulnerability is due to improper error handling when parsing...

CVE-2026-17623

Langflow OSS 1.0.0–1.10.3 is affected by CVE-2026-17623: a remote authenticated attacker can execute arbitrary commands due to improper validation of the command field in MCP server configurations. Affected product is Langflow OSS (versions 1.0.0–1.10.3). The root cause is inadequate validation o...

CVE-2026-17623 Langflow is affected OS Command Injection in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command field in MCP server configurations...

CVE-2026-17630

Langflow OSS 1.0.0–1.10.3 is affected by CVE-2026-17630, where improper validation of configuration parameters could allow a remote attacker to execute arbitrary code. The issue pertains to Langflow OSS components handling MCP/configuration inputs, enabling code execution with network access and ...

CVE-2026-17630 Langflow is affected by security vulnerabilities in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to improper validation of configuration parameters...

CVE-2026-17626 Langflow is affected by security vulnerabilities in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...

CVE-2026-17626

CVE-2026-17626 affects IBM Langflow OSS versions 1.0.0–1.10.3. An authenticated attacker could read, modify, or expose sensitive host files through Docker-based MCP servers due to incomplete filtering of dangerous docker volume-mount and device-mapping arguments. The IBM/NVD entries describe the ...