GHSA-J8F7-X8JM-WMM4 Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

Summary Before Langflow 1.10.3, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses...

Linux Distros Unpatched Vulnerability : CVE-2026-98342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmaengine: wait for RCU readers before releasing dmadevice dmaissuependingall walks the dmadevicelist with listforeachentryrcu under rcureadlock. dmadevicerelea...

PT-2026-115981

Summary Before Langflow 1.10.3, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses...

actinia-core (>=4.9.1, <=4.10.0), adeso (>=0.0.1, <=0.0.4) +28 more potentially affected by CVE-2026-102598 via werkzeug (2.3.6)

werkzeug PYPI version 2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - actinia-core =4.9.1, =0.0.1, =0.1.23, =0.6.14, =1.0.1, =1.0.0, =1.1.0, =2024.1.1, =0.0.1, =0.0.1, =0.0.25, =0.2.27 - fortigate-vpn-login 0.5.0 a...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.1, the NDR array reader in RDPEAR did not perform bounds checking on the number of on-wire elements, and could write beyond the heap buffer allocated from hints, resulting in a heap buffer overflow in...

Astra Linux – Vulnerability in exiv2

In Exiv2 0.26, the Exiv2::IptcParser::decode function in iptc.cpp called from psdimage.cpp in the PSD image reader may experience a denial of service attack due to a heap-based buffer overflow, caused by an integer overflow occurring through a specially crafted PSD image file...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipv4: Fixed data races related to sysctlfibmultipathhashfields. When reading sysctlfibmultipathhashfields, it can be changed concurrently. Therefore, we need to add READONCE to its readers...

Astra Linux – Vulnerability in exiv2

There is a vulnerable assertion in the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp of Exiv2 0.26, which can lead to a remote denial-of-service attack due to malicious input...

Astra Linux – Vulnerability in libarchive

“executefilteraudio” in “archivereadsupportformatrar.c” in “libarchive” before version 3.7.5 allows out-of-bounds access via a crafted archive file, as “src” can move beyond “dst”...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page and a malicious server...

[SECURITY] Fedora 45 Update: xreader-4.6.9-2.fc45

X-Apps Document Reader is a document viewer capable of displaying multiple and single page document formats like PDF and PostScript...

[SECURITY] Fedora 45 Update: newsboat-2.44-3.fc45

Newsboat is a fork of Newsbeuter, an RSS/Atom feed reader for the text consol e...

[SECURITY] Fedora 45 Update: liferea-2.0.1-2.fc45

Liferea Linux Feed Reader is an RSS/RDF feed reader. It's intended to be a clone of the Windows-only FeedReader. It can be used to maintain a list of subscribed feeds, browse through their items, and show their contents...

CVE-2026-104020

Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value. To remediate this issue, users should upgrade to version...

CVE-2026-104020 Uncontrolled recursion in the Ion reader in Amazon Ion Python

Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value. To remediate this issue, users should upgrade to version...

CVE-2026-104020 Uncontrolled recursion in the Ion reader in Amazon Ion Python

Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value. To remediate this issue, users should upgrade to version...

CVE-2026-104020 Uncontrolled recursion in the Ion reader in Amazon Ion Python

Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value. To remediate this issue, users should upgrade to version...

CVE-2026-104020

The Amazon Ion Python library (versions prior to 0.15.0 ) is vulnerable to a denial of service due to uncontrolled recursion in the Ion reader . A remote, unauthenticated actor can crash the application by providing a crafted, deeply nested Ion value. To remediate this issue, users should upgrade...

agl-ocr-reader (1.1.1), app-ocr (>=0.0.1, <=1.2.14) +7 more potentially affected by CVE-2026-64847 via anyio (3.7.0)

anyio PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - agl-ocr-reader 1.1.1 - app-ocr =0.0.1, =0.1.0, =0.0.1, =0.1.0, =1.2.0 - yt-fts 0.1.6 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

GHSA-J4PH-9XWF-WCJ4 SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering

Summary /api/attr/getBookmarkLabels is registered with CheckAuth only and applies no filtering of any kind. It runs a scan of the entire blocks table and returns the distinct set of every bookmark label in the workspace. An anonymous reader in publish mode receives the author's complete bookmark...