CVE-2026-68743

SSSD's extract_authtok_v1() in the PAM responder skips validation of auth_token_length against the buffer, allowing a local attacker to trigger an out-of-bounds read and crash via a crafted protocol v1 request. Nessus flags unpatched distros; no in-the-wild exploitation is reported. Apply vendor ...

CVE-2026-68743 Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1

A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the HTTP/2 handling process when nghttp2sessionmemsend is called re-entrantly during the execution of nghttp2sessionmemrecv. An attacker can cause a heap-use-after-free condition by triggering concurrent or re-entrant...

NPM: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

NPM: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

NPM: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

CVE-2026-47764

Summary of CVE-2026-47764 (pdm) : A path-traversal vulnerability in wheel installation arises from InstallDestination.write_to_fs() in src/pdm/installers/installers.py, where a safe validation helper (_path_with_destdir()) was replaced with a bare os.path.join(), removing path validation. Version...

CVE-2026-70473

Flowise (a UI for building LLM workflows) prior to version 3.1.3 exposed a server-wide upsert-history via GET /api/v1/upsert-history. The endpoint returned data scoped to none of the requester’s identity (user/tenant/workspace) and could exceed 100 MB, including sensitive configuration data such ...

K000162775: PHP Phar vulnerability CVE-2026-7260

Security Advisory Description Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-7260 Impac...

NPM: Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

NPM: Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

CVE-2026-70471 Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetche...

WordPress Super Progressive Web Apps plugin <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by lucsob in WordPress Plugin Super Progressive Web Apps versions = 2.2.43...

CVE-2026-70470 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

EUVD-2026-52811

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

EUVD-2026-52808

A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMacProcessMsgDeleteMonitoredItemsResponse of the file src/ClientServer/frontend/clientwrapper/internal/statemachine.c of the component DeleteMonitoredItemsRequest Handler. This manipulation causes...

CVE-2026-69263

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LDLIBRARYPATH, DYLDLIBRARYPATH, and NODEOPTIONS by exact...

CVE-2026-48121

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

CVE-2026-18775

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browsersnapshot of the file tools/browsertool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The...

CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

CVE-2025-29296

H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection vulnerabilities in the /api/esps request handler. The...

UBUNTU-CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...