CVE-2026-13435

IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation...

CVE-2026-12946 Remote Code Execution in CUGA Component CodeAgent

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code...

UBUNTU-CVE-2026-13379

The Windows interactive service in OpenVPN 2.7alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process...

CVE-2026-64870 MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation

MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.updatetool passes caller-supplied downloadurl and downloadcallbackurl values to requests.get without equivalent trusted-host and redirect validation, allowing an authenticated workspace user...

CVE-2026-12942 Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpoints

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

CVE-2026-12932

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote attackers to cause a denial of service memory exhaustion via a flood of crafted packets...

CVE-2026-11771

OpenVPN version 2.1.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server...

EUVD-2026-51184

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints...

CVE-2026-53431

Boruta (malach-it) Authentication Bypass via Capture-replay: from 2.3.0 before 2.3.7, JWT client assertions can be replayed after expiry because exp is not validated. Root causes: check_expiration only verifies presence of exp; token_config returns an empty map, so Joken’s exp validator is not en...

CVE-2026-65635

Improper Isolation or Compartmentalization vulnerability in malach-it boruta Elixir.Boruta.Openid module allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.registerclient/3 forwards caller-supplied...

CVE-2026-11980

The CVE-2026-11980 entry affects IBM Aspera Desktop App versions 1.0.5 through 1.0.19. The issue allows arbitrary code execution by loading DLL files at startup, stemming from Use of Inherently Dangerous Function (CWE-242). Impact is high (Local with user interaction required, per CVSS: 3.1, AV:L...

EUVD-2026-51136

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability...

CVE-2026-60074

Date::Manip for Perl up to v6.99 is affected by CVE-2026-60074. The bug arises because parse regexes use \d (matching Unicode decimal digits) for year/month/day, while downstream numeric checks only validate ranges, and Perl truncates non-ASCII digits when numifying. This can cause a parsed date ...

OPENSUSE-SU-2026:21486-1 Security update for tomcat

This update for tomcat fixes the following issues: Update to Tomcat 9.0.120. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

SUSE-SU-2026:3419-1 Security update for tomcat

This update for tomcat fixes the following issues: Update to Tomcat 9.0.120. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

CVE-2026-67246

A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not sufficiently validated before being used for file access. An authenticated attacker can exploit this issue to access or manipulate files outside...

Out-of-bounds Read

Overview Magick.NET-Q16-HDRI-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

PT-2026-66569

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description Improper control of user input code allows a remote attacker to inject and execute arbitrary code on the system. Recommendations At the moment, there is no information about a newer...

PT-2026-66482

Name of the Vulnerable Software and Affected Versions IBM Aspera Desktop App versions 1.0.5 through 1.0.19 Description An issue exists that allows arbitrary code execution by loading DLL files during the application start-up process. Recommendations At the moment, there is no information about a...

The vulnerability of Microsoft Office packages, Microsoft SharePoint Server, and Microsoft 365 Apps for Enterprise, related to reading data outside of the allowed range in memory, allows attackers to disclose sensitive information.

The vulnerability of Microsoft Office packages, Microsoft SharePoint Server, and Microsoft 365 Apps for Enterprise involves reading data beyond the allowed range in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information...