PT-2026-89602

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery SSRF that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints...

PT-2026-89613

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

CVE-2026-52097

An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, afLaunchLocalUri urllauncher.dart, OpenFilex.open, localPathRegex commonpatterns.dart components...

PT-2026-89617

🚨 CVE-2026-79724 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command. 🎖@cveNotify...

ROS-20260910-73-0057

The vulnerability in Chromium is related to a violation of data protection mechanisms. Exploiting this vulnerability allows an attacker who operates remotely to circumvent existing security restrictions...

PT-2026-89625

🚨Critical - IBM Langflow OSS Graph Construction Code Injection CVE-2026-81204 IBM Langflow OSS graph construction accepts attacker-controlled node/graph definitions that can inject code during graph build due to missing execution guards and incomplete security controls. Remote exploitation enable...

PT-2026-89647

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header...

PT-2026-89618

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...

PT-2026-89578

An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 v2, v3 & v5 and TL-MR6400 v8. Due to insufficient validation of user-supplied file information, an authenticated remote attacker with access to the affected upload functionality cou...

CVE-2026-78573: Use of Default Credentials

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

ROS-20260910-73-0002

The vulnerability in Chromium is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260910-73-0098

The vulnerability in Chromium is related to information representation errors in the user interface. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks...

ROS-20260910-73-0053

The vulnerability in Chromium is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

CVE-2026-73788

A vulnerability in the ClearPass OnGuard agent could allow an authenticated remote attacker to elevate their own privileges on a vulnerable ClearPass OnGuard deployment. Successful exploitation could allow an attacker to obtain root privileges, leading to potentially unauthorized operation of the...

CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2026-40635

Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to denial of service and information tampering...

CVE-2026-78662

A flaw was found in golang.org/x/crypto/ssh. A malicious remote attacker could flood a channel's incoming requests before it is established, leading to a deadlock of the entire connection. This could result in a denial of service DoS for legitimate users. Mitigation Red Hat is not aware of a...

CVE-2026-85630

A flaw was found in perl-HTML-FormHandler. This vulnerability allows a remote attacker to inject malicious scripts into web pages due to the processattrs method failing to properly escape field attributes when rendering HTML. By manipulating input, an attacker can embed JavaScript, leading to...

CVE-2026-21092

Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege...

CVE-2026-87534

A flaw was found in WebView in Google Chrome. This missing authorization vulnerability allows a remote attacker, by leveraging social engineering techniques, to bypass system access restrictions. This can be achieved through specially crafted network traffic...