1814 matches found
CVE-2025-49506 Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...
CVE-2026-9081
IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery SSRF vulnerability in the validatemodelproviderkey function for the Ollama provider. The function accepts a user-supplied OLLAMABASEURL parameter and passes it directly to requests.get without...
CVE-2026-9081
IBM Langflow OSS (versions 1.0.0–1.10.3) is affected by an SSRF in the Ollama provider due to validate_model_provider_key() accepting a user-supplied OLLAMA_BASE_URL and passing it directly to requests.get() without validating scheme/host allowlisting or private IP filtering. This can allow an at...
CVE-2026-9081 Langflow OSS is affected by server-side request forgery in provider validation and API request functionality
IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery SSRF vulnerability in the validatemodelproviderkey function for the Ollama provider. The function accepts a user-supplied OLLAMABASEURL parameter and passes it directly to requests.get without...
MAL-2026-13096 Malicious code in boxy-validate-implicit-deps (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04288ec5388fa5634c253b28690e3e5b4b1220fbc9d07440fbb1c8a70860b0e5 On require of the package, index.js loads loader.js which selects a per-platform payload path and fetches an opaque binary from one of four hardcoded...
MAL-2026-12688 Malicious code in delivery-ci-validate (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a6fb547c4fb156493439557692dc83b73f44deee6687ec535882f7e8ccf490 Requiring delivery-ci-validate loads polyfill.js, which assembles destination hostnames from split string fragments joined at runtime e.g...
Malicious code in delivery-ci-validate (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a6fb547c4fb156493439557692dc83b73f44deee6687ec535882f7e8ccf490 Requiring delivery-ci-validate loads polyfill.js, which assembles destination hostnames from split string fragments joined at runtime e.g...
CVE-2026-64578
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound chained SMB2 request, ksmbdsmb2checkmessage reads pdu-StructureSize2 without first checking that the compound element is large...
PT-2026-68295
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description A Server-Side Request Forgery SSRF issue exists in the validate model provider key function for the Ollama provider. The function processes a user-supplied OLLAMA BASE URL parameter an...
CLSA-2026-1784682764 TuxCare security update for npm-user-validate (1 CVE)
TuxCare rebuilt npm-user-validate to address 1 CVE. Fixed in 0.1.5-tuxcare.1...
CLSA-2026-1772583197 TuxCare security update for npm-user-validate (1 CVE)
TuxCare rebuilt npm-user-validate to address 1 CVE. Fixed in 0.1.2-tuxcare.1...
CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
EUVD-2026-52692
Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval with only...
CVE-2026-67195
CVE-2026-67195 describes a remote code execution in Perspective 5.0.0 via an eval() expression injection in the PolarsVirtualServer backend. The vulnerability occurs when client-supplied input is passed directly to Python’s eval() with almost no sandboxing (builtins cleared). Attackers can traver...
aioauth-client (>=0.9.2, <=0.9.3), aiohttp-validate (>=0.1.0, <=1.0.0) +10 more potentially affected by CVE-2026-69243 via aiohttp (1.0.5)
aiohttp PYPI version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioauth-client =0.9.2, =0.1.0, =0.0.7, =0.17.0b1, =0.32.0, =1.2.0, =0.10.3, =0.1.8a1, =1.0.0a2, =1.0.0a3 Source cves: CVE-2026-69243 Source...
aioauth-client (>=0.9.2, <=0.9.3), aiohttp-validate (>=0.1.0, <=1.0.0) +10 more potentially affected by CVE-2026-59881 via aiohttp (1.0.5)
aiohttp PYPI version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioauth-client =0.9.2, =0.1.0, =0.0.7, =0.17.0b1, =0.32.0, =1.2.0, =0.10.3, =0.1.8a1, =1.0.0a2, =1.0.0a3 Source cves: CVE-2026-59881 Source...
Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)
SummaryNumerous HTTP-emitting modules core.api.httpget, core.api.httppost, graphql.query/graphql.mutation, monitor.httpcheck, communication.slacksend, notification.discord,slack,teams.sendmessage, ai.visionanalyze anthropic path, verify.visualdiff, browser.proxyrotate, and the agent/llm inline...
CVE-2026-11836
Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware validatedebugunlocktoken in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued fo...
Incorrect Behavior Order: Validate Before Canonicalize
Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via the request URI handling. An attacker can access resources on hosts that should have been excluded by bypassing host-based access controls through manipulation of noncanonical...