Langflow has an Information Leak through Incomplete API Key Redaction

A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function removeapikeys/hasapiterms of the file src/backend/base/langflow/api/utils/core.py of the component Flow Using API. This manipulation causes unprotected storage of credentials. The attack can be initiated...

CVE-2026-6597 langflow-ai langflow Flow Using API core.py has_api_terms credentials storage

A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function removeapikeys/hasapiterms of the file src/backend/base/langflow/api/utils/core.py of the component Flow Using API. This manipulation causes unprotected storage of credentials. The attack can be initiated...

CVE-2026-6597

langflow-ai (Flow Using API) up to version 1.8.3 is affected by CVE-2026-6597. The vulnerability resides in the code path src/backend/base/langflow/api/utils/core.py, specifically the remove_api_keys/has_api_terms functions, which enables unprotected storage of credentials. The issue can be explo...

The vulnerability of the Jenkins automation server lies in the lack of protection for service data, allowing attackers to gain unauthorized access to the protected information.

The vulnerability of the Jenkins automation server lies in the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the sub_401F80() function in the microprogramming software for Wavlink WL-WN579A3 allows attackers to carry out XSS attacks.

The vulnerability of the sub401F80 function in the microprogramming software for Wavlink WL-WN579A3 relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a remote attacker to perform XSS attacks...

HP Color LaserJet Exposure of Sensitive Information to an Unauthorized Actor (CVE-2005-2988)

HP LaserJet 2430, and possibly other printers that use Jetdirect controls, stores information about recently printed documents without proper protection, which could allow remote attackers to obtain sensitive information via SNMP. This plugin only works with Tenable.ot. Please visit...

PT-2026-33742

Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings. This vulnerability has been...

The vulnerability of the software for coordinating the operation of security systems and for managing real-time incident responses in Fortinet FortiSOAR lies in the lack of protection for website structures. This allows attackers to execute XSS attacks.

The vulnerability of the graphical user interface of the software solution for coordinating the operation of cybersecurity systems and for managing incident responses in real-time is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a...

ROS-20260417-73-0009

Vulnerability in glpi-plugin-mreporting related to failure to take measures to protect sql query structure. Exploitation of the vulnerability could allow a remote attacker to execute arbitrary code...

Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox

Summary A Server-Side Request Forgery SSRF protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTPDENYLIST for axios and node-fetch libraries, the built-in Node.js http, https, and net modules are allowed in the NodeVM sandb...

Weblate: SSRF via the webhook add-on using unprotected fetch_url()

Impact The webhook add-on did not utilize existing SSRF protection. Patches https://github.com/WeblateOrg/weblate/pull/18815 Workarounds Disabling the add-on would avoid misusing this. References Thanks to @Lihfdgjr for reporting this via GitHub...

GHSA-F8HV-G549-HWG2 Weblate: SSRF via the webhook add-on using unprotected fetch_url()

Impact The webhook add-on did not utilize existing SSRF protection. Patches https://github.com/WeblateOrg/weblate/pull/18815 Workarounds Disabling the add-on would avoid misusing this. References Thanks to @Lihfdgjr for reporting this via GitHub...

The vulnerability of the platform for creating, publishing, and reproducing digital advertising on Adobe Experience Manager (AEM) Screens lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the Adobe Experience Manager AEM Screens platform, which is used for creating, publishing, and reproducing digital advertisements, is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute...

The vulnerability of the platform for creating, publishing, and reproducing digital advertising on Adobe Experience Manager (AEM) Screens lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the Adobe Experience Manager AEM Screens platform, which is used for creating, publishing, and reproducing digital advertisements, is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute...

CVE-2026-39845

Weblate (web-based localization tool) has a vulnerability in versions prior to 5.17 where the webhook add-on did not apply SSRF protections. The root cause is exposure via the webhook add-on’s fetch_url() path, enabling potential SSRF risks as described in the CVE entry. The issue is fixed in ver...

CVE-2026-39845 Weblate: SSRF via the webhook add-on using unprotected fetch_url()

Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround...

The vulnerability of the Microsoft SQL Server database management system lies in the lack of measures taken to protect SQL query structures, allowing attackers to enhance their privileges.

The vulnerability of the Microsoft SQL Server database management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2025-13822

MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges...

CVE-2025-13822

CVE-2025-13822 concerns MCPHub versions below 0.11.0, where authentication bypass exists due to endpoints lacking authentication middleware. An unauthenticated attacker could perform actions in the name of other users with their privileges. The provided metrics indicate low impact on confidential...

CVE-2025-13822 Authentication bypass in MCPHub

MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges...