EUVD-2026-93431

LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the generated search...

CVE-2026-105799

LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the generated search...

CVE-2026-105799 LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values

LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the generated search...

CVE-2026-105799

The @langchain/redis component in LangChain (prior to version 1.1.1 ) is vulnerable to RediSearch Filter Injection due to a failure to escape attacker-controlled values in structured TAG and TEXT filters. An attacker can inject RediSearch syntax to modify or broaden search queries. If an applicat...

Malicious code in @kxa/xbails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

CVE-2026-87975

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...

UBUNTU-CVE-2026-98359

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ibgetethspeed ibdevicegetnetdev intentionally returns a referenced netdevice even when it is unregistering, so matching and cleanup callers can still find the association. The reference...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via redundant regular expression compilation in query parameter decoding

A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a Denial of Service DoS by sending requests containing a large number of query parameters to an affected endpoint. Due to redundant regular expression compilation within the parameter decoding loop, processing these...

MAL-2026-17341 Malicious code in @badzz88/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @badzz88/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

CVE-2026-104040

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol OData queries. A low-privileged local user can exploit this flaw by submitting a crafted...

CVE-2026-104040

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol OData queries. A low-privileged local user can exploit this flaw by submitting a crafted...

CLEANSTART-2026-RH85110 Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query

Security vulnerability affects the sonarqube package. Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query...

CLEANSTART-2026-MC77082 ReverseProxy can forward queries containing parameters not visible to Rewrite functions

Security vulnerability affects the temporal-server package. ReverseProxy can forward queries containing parameters not visible to Rewrite functions...

CLEANSTART-2026-DH14395 net/url package does not set a limit on the number of query parameters in a query

Security vulnerability affects the go1.27 package. The net/url package does not set a limit on the number of query parameters in a query...

Rocky Linux 10.1 [CIQ] Security Update: glibc / glibc-all-langpacks / glibc-benchtests / etc Multiple Vulnerabilities (crlsa-2026_1334)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261334 advisory. glibc: Integer overflow in memalign leads to heap corruption CVE-2026-0861 glibc: glibc: Information disclosure via zero-valued network query...

PT-2026-106485

SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...

PT-2026-106853

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

CVE-2026-102404: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memor...

Security Advisory 0191

Security Advisory 0191 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-102156 CVSSv3.1 Base Score: 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N CVSSv4.0 Base Score: 6.9...