CVE-2026-93678

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to a security flaw caused by improper authorization . A remote authenticated attacker could exploit this weakness to obtain sensitive information . The vulnerability is associated with CWE-639 (Authorization Bypass Through User-Control...

CVE-2026-93679

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to a denial of service (DoS) attack. The root cause is uncontrolled resource consumption occurring during the extraction of ZIP files . A remote authenticated attacker could exploit this to exhaust system resources. No specific exploit...

CVE-2026-93674

Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to a critical remote code execution (RCE) flaw (CVE-2026-93674 ). The root cause is the improper neutralization of special elements used in an OS command (CWE-94), which allows a remote attacker to execute arbitrary code. This vulnerabilit...

CVE-2026-97671

IBM Langflow OSS versions 1.0.0 through 1.12.2 are susceptible to a path traversal vulnerability (CWE-22 ). This flaw could allow a remote authenticated attacker to obtain sensitive information . No specific exploit details, impacts beyond information disclosure, or remediation steps are provided...

CVE-2026-97673

The Langflow OSS software versions 1.0.0 through 1.12.2 are affected by CVE-2026-97673 , which allows a remote authenticated attacker to execute arbitrary code due to improper input validation (CWE-693 ). This vulnerability can lead to high impact on confidentiality, integrity, and availability. ...

CVE-2026-107310

The Freelinking plugin allows users to create links to site and external content using a WIKI-like input filter. The module fails to sufficiently prevent page titles from being viewed for certain privately-accessible URLs . This vulnerability is mitigated because an attacker must have authorized ...

CVE-2026-107264

The Inline Formatter Field module is vulnerable to template injection due to improper protection during parsing. This flaw allows users to render protected data or execute unsafe Twig commands . No specific affected versions, remediation steps, or exploit links are provided in the documents.

CVE-2026-107250

Technical details for CVE-2026-107250 are not publicly available in the provided documents. Action: monitor for updates.

CVE-2026-107309

The DRUPAL-CONTRIB module for breadcrumb trails in taxonomy term hierarchies fails to sufficiently verify view access for parent terms prior to rendering breadcrumb segments. This flaw could allow users to view information they are not authorized to access. The vulnerability is mitigated unless t...

CVE-2026-31001

The DarkSword/Coruna platform for iOS utilizes a JavaScriptCore type confusion vulnerability in garbage collection/JIT (CVE-2026-31001). While currently in development on host 23.148.212.237 , the vulnerability targets iOS 26 ; however, the kernel and sandbox-escape stages remain as one-byte plac...

CVE-2025-70517

The request handler in Fanvil x7a firmware version 2.6.0.1182 fails to enforce cross-origin resource protection for state-changing requests. This lack of protection allows for a complete bypass of the cross-origin boundary, enabling Cross-Site Request Forgery (CSRF) attacks against any applicatio...

CVE-2026-107253

Technical details for CVE-2026-107253 are not publicly available in the provided documents. Action: monitor for updates.

CVE-2026-107261

A DRUPAL-CONTRIB module providing TOTP-based two-factor authentication (2FA) may allow a user to log in using only a password. This occurs even when the site-wide enforcement of 2FA is enabled. No specific version numbers, root causes, or remediation steps are provided in the documents. Exploitat...

CVE-2026-107249

The Block AJAX module for Drupal is vulnerable to PHP Object Injection and Remote Code Execution due to insufficient validation of user-supplied data used to construct blocks. This issue specifically affects sites with Layout Builder enabled or other block plugins that handle the module's data in...

CVE-2026-46572

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfsibcuttail in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a specially crafted directory...

CVE-2026-107258

The module renders entity add/edit forms inside an AJAX dialog for entity reference fields. The vulnerability stems from the module relying solely on the "access administration pages" permission without verifying if the current user has specific create or update access to the entity itself. This ...

CVE-2026-42618

A single-byte heap buffer overflow exists in the ntfs-3g component (before version 2026.7.7 ) within the ntfs_decompress() function in compress.c. An attacker can exploit this by crafting a malicious NTFS image and triggering the overflow by reading the specially crafted file. The vulnerability a...

CVE-2025-70522

The Fanvil x7a firmware version 2.6.0.1182 is vulnerable to Cross-Site Request Forgery (CSRF) attacks. The issue stems from the request handler failing to enforce cross-origin resource protection for state-changing requests. This allows an attacker to bypass cross-origin boundaries and perform un...

CVE-2025-70516

The Fanvil x7a device, running firmware version 2.6.0.1182 , contains a vulnerability in its websocket handler due to a lack of proper authentication restrictions for sessionless users. This security flaw allows unauthenticated attackers to access various device resources, including operational l...

CVE-2026-107259

The Linked Field module for Drupal fails to sufficiently separate field content from template code when rendering linked field output. Depending on the installed Twig extensions , this flaw could allow for the exposure of sensitive site configuration values, such as API keys or credentials . Expl...