CVE-2026-55255 Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference IDOR vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in...

CVE-2026-55255

Summary of technical details : CVE-2026-55255 is an IDOR in Langflow prior to version 1.9.1 where an authenticated user could trigger a victim’s flow by supplying the victim’s flow UUID to the /api/v1/responses endpoint. The root cause is in get_flow_by_id_or_endpoint_name(), which could load a F...

CVE-2026-56784

OpenRemote before 1.25.0 contains an insecure direct object reference IDOR vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms method in AlarmResourceImpl.java...

MINI-JV29-WJJ6-F8M4

Bulletin has no description...

MINI-54P3-GRM6-MVPC

Bulletin has no description...

CVE-2026-56784 OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint

OpenRemote before 1.25.0 contains an insecure direct object reference IDOR vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms method in AlarmResourceImpl.java...

CVE-2026-56784

OpenRemote before 1.25.0 contains an insecure direct object reference IDOR vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms method in AlarmResourceImpl.java...

EUVD-2026-38444

OpenRemote Manager before 1.24.2 contains an insecure direct object reference vulnerability in the removeAlarms method that allows authenticated users to delete alarms from other tenants by supplying arbitrary alarm IDs. The bulk deletion endpoint fails to validate that targeted alarm IDs belong ...

CVE-2026-56784 OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint

OpenRemote before 1.25.0 contains an insecure direct object reference IDOR vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms method in AlarmResourceImpl.java...

CVE-2026-56784

OpenRemote Manager before 1.24.2 contains an insecure direct object reference in removeAlarms(), enabling authenticated users to delete alarms across tenants by supplying arbitrary alarm IDs. The bulk deletion endpoint does not validate that IDs belong to the caller’s realm, enabling cross-tenant...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: fs/xattr: The fdput function is missing in the fremovexattr error path. In the Linux kernel, the fremovexattr system call calls fdget to obtain a file reference, but returns early without calling fdput when strncpyfromuser fails...

MINI-954P-M2PG-M79J

Bulletin has no description...

MINI-Q5X2-2RWH-5V9C

Bulletin has no description...

MINI-PHVC-3MJF-C77R

Bulletin has no description...

CVE-2026-11833

creationtimestamp| type| source ---|---|--- 2026-06-23 03:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mowfv5w3xq2w 2026-06-23 03:00:35+00:00| seen| https://infosec.exchange/users/offseq/statuses/116797186334941765 2026-06-23 03:15:09+00:00| seen|...

python3.9 security update

3.9.25-7.0.1 - Remove upstream URL reference 3.9.25-7 - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161 3.9.25-6 - Security fix for CVE-2026-4519 Resolves: RHEL-158117 3.9.25-5 - Rebuilding previous fixes for different build target Related: RHEL-143117,...

MINI-PQQ2-86H6-W38J

Bulletin has no description...

CVE-2026-49461

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. This vulnerability is fixed in 6.12....

DEBIAN-CVE-2026-49461

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. This vulnerability is fixed in 6.12....

Paymenter has broken object level authorization via service reference manipulation on ticket creation

Summary The ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing services belonging to other accounts by modifying the service ID in the request. Technical Details The ticket...