119449 matches found
IBM Langflow OSS path traversal vulnerability
IBM Langflow OSS is an open-source low-code visual AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to integrate wit...
The vulnerability of React Router’s routing library in React applications stems from the redirection of URLs to unreliable websites, allowing attackers to carry out phishing attacks.
The vulnerability of the React Router routing library for React applications relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a remote attacker to carry out phishing attacks...
Linux Distros Unpatched Vulnerability : CVE-2026-18446
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based...
PT-2026-66751
A reflected cross-site scripting XSS vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1...
Brother MFC-9970CDW Printers Cross-site Scripting (CVE-2013-2671)
Multiple cross-site scripting XSS vulnerabilities in the Brother MFC-9970CDW printer with firmware L 1.10 allow remote attackers to inject arbitrary web script or HTML via the 1 id or 2 val parameter to admin/adminmain.html; 3 id, 4 val, or 5 arbitrary parameter name QUERYSTRING to...
openSUSE 16 Security Update : libkrun (openSUSE-SU-2026:21464-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21464-1 advisory. - CVE-2025-24898: openssl: use-after-free in ssl::selectnextproto due to improper lifetime handling bsc1270429. - CVE-2026-41676: openssl: short...
PT-2026-66852
Name of the Vulnerable Software and Affected Versions free5GC versions prior to 1.4.5 Description The AUSF Authentication Server Function fails to validate the supiOrSuci field in UE authentication requests. Null bytes x00 and other control characters are passed through JSON parsing and forwarded...
PT-2026-66838
Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description HMAC validation can be bypassed due to the use of the Python .replace method when removing the signature from the URL before validation. Because .replace removes all occurrences of the substring rath...
CVE-2026-67350: URL Redirection to Untrusted Site
Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter when the Track Exits plugin is configured with commentredirection set to s9y...
CVE-2026-62999: Improper Limitation of a Pathname to a Restricted Directory
Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...
CVE-2026-53504: Uncontrolled Resource Consumption
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0...
PT-2026-66729
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the SAML protocol implementation when handling authentication requests via the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can...
CVE-2026-45377: Exposure of Sensitive Information to an Unauthorized Actor
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...
CVE-2026-55768
creationtimestamp| type| source ---|---|--- 2026-07-30 22:44:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/i756bnxfs3slr...
CVE-2026-11536
creationtimestamp| type| source ---|---|--- 2026-07-30 22:16:19+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrvhpxhewy2y 2026-08-06 14:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msgbdb2yns2v...
CVE-2026-67530
WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation sendwebhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the...
CVE-2026-14602
creationtimestamp| type| source ---|---|--- 2026-07-30 20:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrva4fhjpv2v 2026-08-06 20:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msgu7ogxhb2c...
CVE-2026-64870
MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.updatetool passes caller-supplied downloadurl and downloadcallbackurl values to requests.get without equivalent trusted-host and redirect validation, allowing an authenticated workspace user...