CVE-2026-70435

A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2026-70433

Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70433

Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70433

CVE-2026-70433 : Jenkins HCL AppScan Plugin

CVE-2026-7646

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP resources/read request with a URL-encoded path...

CVE-2026-7646

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP resources/read request with a URL-encoded path...

CVE-2026-7646

CVE-2026-7646 affects IBM Langflow OSS 1.0.0–1.10.3. Affected component: Model Context Protocol (MCP) resources/read handling. Root cause: URL-encoded path traversal in the filename enables a crafted MCP request to read arbitrary server files (including other users’ documents, JWT signing secret,...

EUVD-2026-53464

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP resources/read request with a URL-encoded path...

CVE-2026-70604

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remot...

CVE-2026-70598

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could...

CVE-2026-60023

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing...

CVE-2026-67301

A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...

CVE-2026-70604 Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remot...

Out-of-bounds Read

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Out-of-bounds Read in the paint event image generation process when offscreen rendering is enabled. An...

CVE-2026-70598 Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could...

CVE-2026-60023

Vulnerability overview (CVE-2026-60023) : Apache Answer

CVE-2026-60023 Apache Answer: Unauthorized disclosure of deleted or pending answer content

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing...

EUVD-2026-53401

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing...

CVE-2026-11404

A flaw was found in Mongoose. An out-of-bounds read vulnerability exists in the built-in TLS server function mgtlsserverrecvhello. A remote, unauthenticated attacker can exploit this by sending a specially crafted TLS ClientHello message with an oversized session ID length. This can lead to readi...

CVE-2026-7529

The CVE describes a vulnerability in the wiseCampaign – WooCommerce Conversions Made Easy WordPress plugin (versions '__return_true'. This allows unauthenticated attackers to read and modify plugin settings and assets (banner, stockbar, core settings, background uploads) without nonce or capabil...