CVE-2026-62137

CVE-2026-62137 affects the WordPress bbPress plugin , versions 2.6.14 and earlier , and involves a Sensitive Data Exposure vulnerability discovered by Ananda Dhakal (Patchstack). The initial CVE entry is still in reserved status, but the connected Patchstack record confirms the affected product a...

CVE-2026-16174 Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow

Netskope was notified about a potential gap in Netskope Endpoint DLP EPDLP running on Windows systems. Successful exploitation of the gap could potentially allow a privileged user to send a crafted message to the EPDLP process port to trigger an integer overflow, leading to memory corruption...

CVE-2026-16172 Netskope Endpoint DLP Service Out-of-Bounds Read Leading to Process Crash

Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP EPDLP service of the Netskope Client. A local standard user could potentially send a specially crafted message that is not properly validated with a bounds check, likely crashing the kernel driver handler. Successful...

CVE-2026-2310

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2026-19646

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header...

CVE-2026-49838

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length ASPATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP...

CVE-2026-49837

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded b...

CVE-2026-54054

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, POST /api/files/url, is vulnerable to Server-Side Request Forgery SSRF. The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects...

CVE-2026-49836

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

CVE-2026-75624

IBM App Connect Enterprise (runtime) versions 13.0.1.0–13.0.8.1 and 12.0.1.0–12.0.12.27 are vulnerable to privilege escalation and Denial of Service due to incorrect authorization (CWE-863). A remote authenticated attacker with low privileges can bypass security restrictions, yielding full compro...

CVE-2026-75777

IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.5 are vulnerable to a container escape caused by unrestricted system calls being permitted within the container. A local attacker with low privileges can exploit this to break out of the container, resulting in high impact to confidentialit...

CVE-2026-76059

IBM Langflow OSS versions 1.0.0 through 1.11.5 are affected by a protection mechanism failure (CWE-693) in its static code security scanner. An attacker who can submit custom component source code can bypass the scanner by crafting an annotated class-body assignment that resolves to a dangerous c...

CVE-2026-78569

IBM Langflow OSS (versions 1.0.0 through 1.11.5) is vulnerable to arbitrary code execution by an authenticated attacker due to an incomplete denylist in its agentic assistant code security scanner. The scanner omits process-spawning primitives and contains a logic error where annotated class-body...

CVE-2026-78571

IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to arbitrary code execution via an unguarded eval() call in the lfx CodeParser , which passes return-type annotation source directly to eval without sanitization (CWE-94). A remote authenticated attacker can exploit this to execute arb...

CVE-2026-78573

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

CVE-2026-45770

Suricata versions 8.0.0 through 8.0.5 (exclusive) are affected by a Lua sandbox bypass. A Lua rule that registers an excessive number of flow variables can corrupt Lua detection state , potentially escaping Suricata's restricted Lua sandbox. The attack requires a crafted Lua script/rule to be loa...

CVE-2026-78575

IBM Langflow OSS 1.0.0–1.11.5 is vulnerable to OS command injection (CWE-78) in the MCP stdio server configuration , allowing a remote authenticated attacker to execute arbitrary commands. The root cause involves two gaps: the MCP stdio validator on Windows recognizes only one cmd.exe execution s...

CVE-2026-79723

IBM Langflow OSS versions 1.0.0 through 1.11.5 allow a remote authenticated attacker to perform server-side request forgery (SSRF) via several connectors that skip the platform's shared SSRF validation guard. Affected components include the MCP server configuration URL field, the DataStax Astra D...

CVE-2026-79724

IBM Langflow OSS versions 1.0.0 through 1.11.5 are affected by an OS command injection vulnerability (CWE-78) caused by multiple incomplete code security controls and missing execution guards, including an incomplete denylist omitting process-spawning primitives, a logic error in the code scanner...

CVE-2026-79725

IBM Langflow OSS versions 1.0.0 through 1.11.5 are affected by an improper access control flaw (CWE-284 ) that allows a remote authenticated attacker to read arbitrary files. The vulnerability is part of a broader set of storage-path issues: the flow execution runtime accepts attacker-controlled ...

CVE-2026-79742

IBM Langflow OSS versions 1.0.0 through 1.11.5 are affected by an incomplete environment variable blocklist in the MCP stdio server configuration. The specific root cause is that the OPENSSL_CONF environment variable is absent from the blocklist, permitting native code execution via OpenSSL engin...

CVE-2026-80378

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an improper authorization flaw that a remote authenticated attacker can exploit to cause a denial of service . The CVSS 3.1 score is 8.5 (HIGH) , with a changed scope, low integrity impact, and high availability impact. The CVE title references...

CVE-2026-80380

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by cross-site request forgery (CSRF) , allowing a remote attacker with no privileges but requiring user interaction to perform unauthorized actions. The flaw is attributed to open source software components within the product, as indicated b...

CVE-2026-45769

Suricata , a network IDS/IPS/NSM engine, is affected by an unbounded memory growth issue in its IKEv2 parser prior to versions 7.0.16 and 8.0.5 . The parser state can grow without bounds while storing client transforms, meaning repeated crafted UDP traffic may cause excessive memory consumption a...

CVE-2026-80434

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an insecure direct object reference (IDOR) flaw that allows a remote authenticated attacker to manipulate runtime caches and cause a denial of service . The vulnerability carries a CVSS 3.1 score of 7.4 (HIGH) , with a scope change indica...

CVE-2026-80424

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is affected by a path traversal vulnerability (CWE-22) that occurs during archive extraction , allowing a remote authenticated attacker to create arbitrary files. The flaw is rated CVSS 9.1 (Critical) with a scope change, reflecting high integri...

CVE-2026-45768

Suricata versions 8.0.0 through prior to 8.0.5 are affected by a resource exhaustion vulnerability in its LDAP application-layer parser . The LDAP transaction state could store an unbounded number of responses per transaction. Because LDAP is processed over UDP , an unauthenticated remote attacke...

CVE-2026-80436

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an improper authorization flaw that allows a remote authenticated attacker to cause a denial of service by deleting arbitrary RabbitMQ queues or exchanges . The vulnerability requires low privileges, is exploitable over the network with no user...

CVE-2026-81204

IBM Langflow OSS (versions 1.0.0 through 1.11.5) is vulnerable to unauthenticated remote code execution (CVSS 9.8, CRITICAL) caused by code injection during graph construction (CWE-94). The root cause involves the lfx CodeParser passing return-type annotation source directly to eval without sanit...

CVE-2026-81207

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in the ds-canvas pod , a shared-infrastructure pod on the OpenShift overlay. Any authenticated tenant—regardless of project membership or role—can fully control the scheme, host, port...

CVE-2026-81210

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to an IDOR combined with path traversal issue. Three caller-supplied strings are concatenated into a String.format path on the shared /ds-storage RWX PVC and the resulting file is returned with no project ACL check. Although reads are cons...

CVE-2026-81211

IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to arbitrary Python code execution by a remote authenticated attacker. The root cause is a missing authorization check (CWE-862): the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY policy is enforced on the direct custom-component endpoint but n...

CVE-2026-81941

IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to arbitrary operating system command execution when an authenticated non-administrative user constructs a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_CO...

CVE-2026-81213

IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to Server-Side Request Forgery (SSRF) (CWE-918) due to missing egress validation on server-side URL fetches. Multiple components fail to apply the platform's shared SSRF guard: the MCP server configuration URL field, the automatic tool...

CVE-2026-81265

IBM Langflow OSS 1.0.0 through 1.11.5 is affected by a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) caused by missing egress validation on server-side URL fetches. Multiple components—MCP server configuration , DataStax Astra DB / HCD connectors , IBM Db2 Vector Store connector , an...

CVE-2026-81268

IBM Langflow OSS 1.0.0–1.11.5 is vulnerable to authentication bypass and insufficient session expiration due to two distinct flaws. First, MCP HTTP API credential resolvers fail to apply the AUTO_LOGIN API-key guard that standard endpoints enforce, causing unauthenticated requests to MCP endpoint...

CVE-2026-45767

Suricata (network IDS/IPS/NSM engine) versions prior to 7.0.16 and 8.0.5 contain a vulnerability in the datasets feature where the save command's protection against absolute filenames can be bypassed when combined with the load command. A malicious rule could potentially overwrite any file on the...

CVE-2026-81540

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by a path traversal vulnerability that allows a remote authenticated attacker to overwrite ruleset files belonging to other tenants . The CVSS 3.1 score is 8.5 (HIGH) with a changed scope, reflecting the cross-tenant integrity impact and low...

CVE-2026-81550

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an OS command injection vulnerability caused by improper neutralization of special elements used in an OS command. A remote authenticated attacker can leverage this flaw to execute arbitrary code , resulting in high impact to confidential...

CVE-2026-81551

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to arbitrarily write to or delete files on shared storage . The CVSS 3.1 score is 8.8 (High) , reflecting network attack vector, low complexity, and high impact...

CVE-2026-81554

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability (CWE-22). According to IBM's security bulletin, this CVE is part of a group of vulnerabilities introduced through open source pac...

CVE-2026-81940

CVE-2026-81940 affects IBM Langflow OSS versions 1.0.0 through 1.11.5 , where improper neutralization of special characters in flow display names permits a remote authenticated attacker to execute arbitrary code. The underlying cause is classified as CWE-94 (Code Injection) : attacker-controlled ...

CVE-2026-82092

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an absolute-path traversal vulnerability that allows a remote, authenticated attacker to obtain sensitive information. The IBM-assigned CVSS 3.1 score is 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high imp...

CVE-2026-82095

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an OS command injection vulnerability caused by improper neutralization of special elements in an OS command, allowing a remote authenticated attacker to execute arbitrary code. The vulnerability scores CVSS 3.1 8.8 (High) with network at...

CVE-2026-82097

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that allows a remote authenticated attacker to execute arbitrary code . The IBM-assigned CVSS 3.1 base score is 8.8 (HIGH) , with network attack vector, low complexity, and high...

CVE-2026-45766

Suricata (network IDS/IPS/NMS engine) is affected by a resource exhaustion flaw in its NFS parser . Prior to versions 7.0.16 and 8.0.5 , certain NFS parser state structures were insufficiently bounded, allowing crafted NFS traffic to cause Suricata to consume excessive memory , potentially leadin...

CVE-2026-82098

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an OS command injection flaw (CWE-78) caused by improper neutralization of special elements used in an OS command. A remote authenticated attacker can leverage this to execute arbitrary commands , resulting in high impact on confidentiali...

CVE-2026-82099

CVE-2026-82099 affects IBM DataStage on Cloud Pak for Data 5.4.0.0 , where a remote authenticated attacker can execute arbitrary code due to OS command injection (CWE-78) — improper neutralization of special elements in an OS command. The vulnerability is network-exploitable with low complexity a...

CVE-2026-82100

CVE-2026-82100 affects IBM DataStage on Cloud Pak for Data 5.4.0.0 , where a path traversal vulnerability (CWE-22) allows a remote authenticated attacker to cause a denial of service . The CVSS 3.1 score is 9.6 (Critical) , with a changed scope indicating cross-boundary impact on integrity and av...

CVE-2026-82107

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains multiple vulnerabilities stemming from bundled open-source software. The primary described issue is improper authentication , which allows a remote authenticated attacker to obtain sensitive information and bypass security restrictions. The ass...