CVE-2026-105740

Langflow versions prior to 1.9.0 are vulnerable to Remote Code Execution (RCE) via the MCP Stdio transport . An authenticated user can execute arbitrary OS commands because the user-supplied command field is passed directly to bash -c "exec {command}" without validation, allowlisting, or sandboxi...

CVE-2026-105740 Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution RCE on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exe...

CVE-2026-105740 Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution RCE on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exe...

-CVE-2014-6271

/ || | | | | | | | / || | | |/ \ / | |/ / \ | || | | | | | | \ | || | | | | | | ' / | | || || | | | || | || . \ |/|| |||||/|| ||/ ||\ CVE-2014-6271 — Shellshock Удалённое выполнение кода через инъекцию в переменные окружения Bash "Ошибка, скрытая в Bash десятилетиями и потрясшая основы...

CVE-2023-4911

CVE-2023-4911 Это PoC Proof Of Concept для уязвимости Looney Tunables, позволяющей повышать привилегии в Linux. Основано на этом PoC. Огромное спасибо leesh3288. Здесь вы можете найти очень подробный разбор, а здесь — посмотреть очень классное видео от IppSec. Использование Проверьте, уязвима ли...

cve-2021-43226PoC

Reproduction de CVE-2021-43226 Environnement Système d'exploitation : Win10 20H2 version 19042.508 sur Hyper-V. J'ai trouvé un site https://os.click/en qui propose des images Windows assez complètes et sans backdoor apparente. Le PoC trouvé étant compilé avec Visual Studio 2013, j'ai également...

shellshock-poc-cve-2014-7169

CVE-2014-6271 - Shellshock PoC Краткое описание CVSS 10.0. Bash некорректно обрабатывает последующие команды после определения функции, хранящегося в переменной окружения, выполняя их во время инициализации оболочки. Первопричина Переменные окружения Bash могут кодировать определения функций: x='...

PoC-for-CVE-2021-38540-

Preuve de concept CVE-2021-38540 Absence d'authentification sur un composant critique connue sous le nom de CVE-2021-38540 À propos de ce bogue : Le point de terminaison d'importation de variables n'était pas protégé par authentification dans Airflow =2.0.0, =2.0.0, variables Liste des variables...

envocabulary

envocabulary Pour chaque variable de votre shell actuel, trouvez le fichier et la ligne qui l'ont définie, ou quel sous-système direnv, launchd, terminal, SSH, système l'a injectée. Plus quelques commandes pour fichiers statiques, pour le moment où votre configuration shell s'est éparpillée sur N...

CVE-2022-22909

CVE-2022-22909 Description Une vulnérabilité d'injection de code a été découverte dans l'application Hotel Druid v3.0.3, qu'un attaquant pourrait exploiter pour exécuter du code à distance sur le serveur. Pour une exploitation réussie, un attaquant doit avoir le privilège d'ajouter une nouvelle...

DEBIAN-CVE-2026-63270

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...

CVE-2026-63270

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...

CVE-2026-63270

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...

CVE-2026-63270

In certain versions of LibreOffice , a vulnerability exists where URLs can be constructed to expand environment variables or INI file values . This allows potentially sensitive information to be exfiltrated to a remote server when a user opens a document containing such links. The root cause is t...

CVE-2026-63270 Environment/ini-file leaks

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...

CVE-2019-25777

A flaw was found in perl-yaml. This vulnerability can lead to arbitrary code execution because the parser fails to restrict package variable modifications specified in YAML documents. An attacker capable of submitting crafted YAML input can overwrite internal configuration settings to enable code...

cve-2021-4034-mock

CVE-2021-4034 PwnKit Mock Vulnerability System Этот проект представляет собой имитационную систему, воспроизводящую ключевой принцип действия уязвимости CVE-2021-4034 Out-of-Bounds Read/Write в демоне pkexec для Linux. Без реального повышения привилегий SUID, в контролируемой среде безопасно...

Important: Red Hat Security Advisory: sudo security update

An update for sudo is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...

CVE-2019-25777

The perl-yaml library (versions before 1.27_001 ) is vulnerable to arbitrary code execution because the parser does not restrict package variable modifications via perl/glob documents. An attacker who can submit crafted YAML input can overwrite internal configuration settings, such as $YAML::Load...