Live feed · cooey

2026-07-20 NVD CVE

CVE-2026-41521: xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer HIGH

xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send...

2026-07-20 NVD CVE

CVE-2026-12341: This vulnerability impacts all versions of IdentityIQ and allows an unauthentica HIGH

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens.

2026-07-18 NVD CVE

CVE-2026-16158: Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 b HIGH

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source...

2026-07-18 NVD CVE

CVE-2026-15631: Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail HIGH

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in...

2026-07-17 NVD CVE

CVE-2026-14501: IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacke MEDIUM

IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions.

2026-07-17 NVD CVE

CVE-2026-13448: IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated re HIGH

IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow_id}/flow ). The vulnerability stems...

agent-componentapi-v1code-act-agentcsv-agentcve-2026-13448denialflow-idibm

2026-07-17 NVD CVE

CVE-2026-13446: IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a CRITICAL

IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or...

authenticationcve-2026-13446data-encryptionencryptionhard-coded-credentialsibminbound-authenticationinternal-data

2026-07-17 NVD CVE

CVE-2026-8859: IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write CRITICAL

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the APIRequest component. A path traversal vulnerability...

api-requestsarbitrary-file-writecontents-dispositioncve-2026-8859ibmincident-responseinput-validationlangflow

2026-07-17 NVD CVE

CVE-2026-8635: IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate pri CRITICAL

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with...

arbitrary-code-executionauthenticate-usercve-2026-8635databases-manipulationibmlangflownvd-cveopen-source-software

2026-07-17 NVD CVE

CVE-2026-8505: IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook CRITICAL

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key...

api-keyauthenticationbypassconfigurationcve-2026-8505default-settingsibmlangflow

2026-07-17 NVD CVE

CVE-2026-8481: IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution v CRITICAL

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes...

api-endpointauthenticate-usercode-validationcve-2026-8481exec-functionibminput-validationlangflow

2026-07-17 NVD CVE

CVE-2026-8476: IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution v CRITICAL

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize...

api-manipulationasyncdiskcachecustom-componentscve-2026-8476deserializationfile-system-accessibmlangflow

2026-07-17 NVD CVE

CVE-2026-15091: IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to CRITICAL

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of input during web page generation.

arbitrary-script-executioncve-2026-15091ibmibm-engineering-ai-hub-1-0-0ibm-engineering-ai-hub-1-1-0ibm-engineering-ai-hub-1-2-0ibm-engineering-ai-hubsimproper-inputs-neutralization

2026-07-17 NVD CVE

CVE-2026-9135: IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 9498 CRITICAL

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that...

agentic-mcpsauthenticate-users-attackscode-injectioncross-tenant-attackcve-2026-9135dynamic-code-validationflow-manipulationibm-langflow

2026-07-17 NVD CVE

CVE-2026-9103: IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unau CRITICAL

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues long-lived superuser bearer...

administrative-accessauthenticationbearer-tokencorcross-origin-resources-sharingcve-2026-9103ibmimproper-authentication

2026-07-17 NVD CVE

CVE-2026-13473: IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 throu HIGH

IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protect is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker...

2026-07-17 NVD CVE

CVE-2026-8297: Improper neutralization of special elements used in an SQL command ('SQL injecti CRITICAL

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management...

applications-securitycode-injectioncve-2026-8297data-breaches-risksdatabase-securitygi-laboratory-management-systemsgis-informatics-engineering-consulting-laboratoryimproper-neutralization

2026-07-17 NVD CVE

CVE-2026-12694: Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform a CRITICAL

Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

access-controlaclcve-2026-12694enterprise-video-platformmissing-authorizationnvd-cvesecurityvimesoft

2026-07-17 NVD CVE

CVE-2026-12693: Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. CRITICAL

Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video...

access-control-listaclauthorization-bypasscve-2026-12693enterprise-video-platformnvd-cvesecurity-bugsoftware-vulnerabilities

2026-07-17 NVD CVE

CVE-2026-9198: IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain CRITICAL ◈ 2 sources · orig. NVD CVE

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve...

api-vulnerabilitiescode-executioncve-2026-9198default-deploymentibmlangflownvd-cveopen-source

2026-07-17 NVD CVE

CVE-2026-12692: Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platf CRITICAL

Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

authentication-bypasscve-2026-12692enterprise-video-platformnvd-cvepassword-changeunverified-password-changevimesoftvulnerability

2026-07-17 NVD CVE

CVE-2026-46420: setup-php is a GitHub action to set up PHP with extensions, php.ini configuratio MEDIUM

setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled...

2026-07-17 NVD CVE

CVE-2026-62241: clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT CRITICAL

clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan...

apiattackauthenticationclawvetcve-2026-62241datum-exfiltrationhard-codedjwt

2026-07-17 NVD CVE

CVE-2026-14956: The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in al CRITICAL

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration...

administrator-accountbricksforgecve-2026-14956nvd-cveplugins-vulnerabilitiesprivileges-escalationsecurity-bulletinunauthenticated-attacks

2026-07-16 NVD CVE

CVE-2026-44181: Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distr CRITICAL

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions 2.0.0rc2 and above, prior to 3.3.0, the environment...

2026-07-16 NVD CVE

CVE-2026-54526: Argo Workflows is an open source container-native workflow engine for orchestrat CRITICAL

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because...

2026-07-16 NVD CVE

CVE-2026-45568: zrok is software for sharing web services, files, and network resources. Prior t CRITICAL

zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to...

cve-2026-45568cybersecurityflaskincident-responseinformation-disclosurenetwork-resourcesnvd-cveproxy

2026-07-16 NVD CVE

CVE-2026-56453: HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vu MEDIUM

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client...

accounts-takeoverauthentication-bypassauthorization-bypasscve-2026-56453hcl-dfxanalytichttps-responses-manipulationnvd-cveremote-attackers

2026-07-16 NVD CVE

CVE-2026-44596: Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoi MEDIUM

Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting,...

account-lockoutauthenticationbrute-forcecve-2026-44596failed-attempts-throttlingframeworkmission-controlnvd-cve

2026-07-16 NVD CVE

CVE-2026-63089: WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographic CRITICAL

WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer...

brute-forcecredentials-theftcryptographic-weaknessescve-2026-63089impersonationnvd-cveone-time-linkpreshared-key

2026-07-16 NVD CVE

CVE-2026-63087: Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability CRITICAL

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using...

admins-usersapi-endpointapi-tokencve-2026-63087grafanagrafana-urlnvd-cveoncall

2026-07-16 NVD CVE

CVE-2023-49900: An unauthenticated remote attacker is able to perform remote code execution due CRITICAL

An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command.

cve-2023-49900exploitincorrectly-sanitize-inputsnvd-cveremote-attackersremote-code-executionsecurity-bulletinsetparameter-command

2026-07-16 NVD CVE

CVE-2023-49899: An unauthenticated remote attacker can execute any command on the affected devic CRITICAL

An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel.

command-executioncommunications-channelscve-2023-49899nvd-cveorigin-verificationremote-attackerssecurityunauthenticate

2026-07-16 NVD CVE

CVE-2026-15013: The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authen CRITICAL

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because...

authentication-bypasscve-2026-15013nvd-cvesamlsaml-signatures-algorithms-confusionsingle-signssowordpress

2026-07-16 NVD CVE

CVE-2026-44182: Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distr CRITICAL

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions prior to 3.3.0, the server interpolates untrusted...

2026-07-15 NVD CVE

CVE-2026-20156: As part of Cisco's ongoing commitment to proactive security and product quality, HIGH

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening...

2026-07-15 NVD CVE

CVE-2026-20157: As part of Cisco's ongoing commitment to proactive security and product quality, HIGH

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening...

2026-07-15 NVD CVE

CVE-2026-53512: Better Auth is an authentication and authorization library for TypeScript. Prior CRITICAL

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession...

accesses-tokenauthenticationauthorizationbetters-authsclient-idclients-secretscve-2026-53512mcp-plugins

2026-07-15 NVD CVE

CVE-2026-54052: n8n-MCP is an MCP server that provides AI assistants access to n8n node document CRITICAL

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLE_MULTI_TENANT=true, n8n-mcp's...

ai-assistantauthorization-headercredentials-exposurecve-2026-54052data-breacheshttps-modemcp-servermulti-tenancy

2026-07-15 NVD CVE

CVE-2026-56400: open-webui before 0.3.14 contains a cross-origin resource sharing misconfigurati HIGH

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers can execute...

admins-usersapi-endpointarbitrary-code-executionattackers-controlled-websitesauthenticate-requestscross-origin-resources-sharingcross-site-requestcve-2026-56400