PT-2026-65914

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.28.x undici versions 8.0.0 through 8.8.x Description The cache interceptor mishandles optional whitespace around the equals sign in qualified no-cache or private Cache-Control directives. The parser may drop the...

KLA91183 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. A remote co...

PT-2026-65712

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

PT-2026-65884

Dify AI Workflow oauth redirect url Open Redirect Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Dify. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

Send and Pretend: Exploiting Transcript Consistency Issues in End-To-End Encrypted Group Chats

End-to-end encrypted E2EE messaging apps are widely praised for their security and thus also used for sensitive coordination in group chats e.g., by political decision makers. After Threema and WhatsApp, also Signal and iMessage have recently introduced polls to aid agreement processes in groups...

PT-2026-65872

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.0 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0 Description An issue exists in the Pipeline Schedule API where improper validation of user-supplied attributes when...

PT-2026-65873

Name of the Vulnerable Software and Affected Versions GitLab EE versions 17.0 through 19.0.4 GitLab EE versions 19.1 through 19.1.2 GitLab EE versions 19.2 through 19.2.0 Description A race condition in approval rule processing may allow an authenticated user to merge code into a protected branch...

PT-2026-65871

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.6 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0 Description An improper authorization check on merge request collaboration settings allows an authenticated user with...

PT-2026-65709

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...

PT-2026-65790

Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor JCE 2.20.2 - Improper input validation in the file rename functionality allowed an authenticated user with file management permissions to rename files t...

CVE-2026-13442

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results...

CVE-2026-13442

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results...

EUVD-2026-50066

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results...

CVE-2026-13442 Langflow is affected by NET Misconfiguration: Use of Impersonation due to multiple unauthenticated and insufficiently authorized API endpoints

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results...

CVE-2026-13442

Langflow OSS versions 1.0.0–1.10.1 are affected by CVE-2026-13442. An attacker could reuse another user’s FAISS namespace to access owner‑only vector content and influence later query results, enabling cross‑user information disclosure and limited integrity impact via persistent poisoning of resu...

CVE-2026-1918

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 stores potentially sensitive information in log files that could be read by a...

EUVD-2026-50014

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 stores potentially sensitive information in log files that could be read by a...

DEBIAN-CVE-2026-50738

A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle events. The condition is reachable during normal replication operation, including by a...

CVE-2026-48394

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-48392

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...