Threat database

A heap buffer overflow vulnerability exists in NTFS-3G versions before 2026.7.7 in the ntfs_ib_copy_tail() function within libntfs-3g/index.c. This flaw allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image and triggering the overflow through directory extension operations such as file creation. The vulnerability has a high severity rating with a CVSS score of 7.7.

A heap buffer overflow vulnerability exists in NTFS-3G versions before 2026.7.7 in the ntfs_ir_to_ib() function within index.c. This flaw can be triggered by extending a directory, such as creating a file, using a crafted malicious NTFS image. The vulnerability affects the SUID-root ntfs-3g binary and allows an attacker to corrupt heap memory.

A heap buffer overflow vulnerability exists in NTFS-3G versions before 2026.7.7 in the ntfs_ib_cut_tail() function within libntfs-3g/index.c. This flaw allows an attacker to corrupt heap memory by crafting a malicious NTFS image and creating a file in a specially crafted directory. The vulnerability affects the SUID-root ntfs-3g binary, potentially leading to high impact on confidentiality, integrity, and availability.

A heap buffer overflow vulnerability exists in NTFS-3G versions before 2026.7.7 in the ntfs_decompress() function of compress.c. This flaw allows an attacker with local privileges to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The vulnerability can be triggered by reading a specially crafted file. It has a CVSS score of 7.1, indicating high severity, with impact on integrity and availability but no confidentiality loss.

CVE-2026-88514 is a medium severity vulnerability in iTerm2 for macOS versions before 3.6.12. It allows a local attacker with low privileges to obtain sensitive information without user interaction. The vulnerability does not affect integrity or availability but impacts confidentiality.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a code injection vulnerability (CWE-94) that allows a remote authenticated attacker to execute arbitrary operating system commands. This occurs due to improper neutralization of special elements in OS command generation. The vulnerability has a high severity rating with a CVSS score of 8.1.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a vulnerability due to improper input validation that could allow a remote authenticated attacker to execute arbitrary code. This issue is classified under CWE-693, indicating a protection mechanism failure. The vulnerability has a high severity with a CVSS score of 8.8, reflecting significant potential impact on confidentiality, integrity, and availability.

CVE-2026-97679 is a high-severity vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.2. It allows a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements in OS commands, a code injection flaw related to improper input validation.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain an improper access control vulnerability in the vertex result caching subsystem. This flaw allows a remote authenticated attacker to access sensitive information or inject malicious data. The vulnerability has a high severity rating with a CVSS score of 8.3.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a vulnerability that allows remote attackers with limited privileges to execute arbitrary code. This is due to an incomplete blocklist in the code security scanner, which fails to properly control code generation. The vulnerability has a high severity rating with a CVSS score of 8.8.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a code injection vulnerability (CWE-94) that allows a remote authenticated attacker to execute arbitrary code. This occurs due to improper neutralization of special elements used in code, potentially enabling a sandbox escape. The vulnerability has a high severity with a CVSS score of 8.8. No patch or official remediation information is provided in the available data.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain an improper access control vulnerability that allows a remote authenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability but compromises confidentiality. It requires authentication and can be exploited remotely with low attack complexity.

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to access sensitive information by bypassing directory restrictions. This vulnerability has a high severity with a CVSS score of 8.1, indicating significant confidentiality and integrity impact without affecting availability.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a critical vulnerability (CWE-94) that allows remote attackers to execute arbitrary code due to improper control of code generation. This vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector, no required privileges or user interaction, and impacts confidentiality, integrity, and availability.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain an improper access control vulnerability that allows a remote authenticated attacker to execute arbitrary code. This vulnerability is identified as CWE-284 and has a high severity rating with a CVSS score of 8.8. The flaw affects versions from 1.0.0 up to and including 1.12.2. No patch or remediation information is currently provided.

An authentication bypass vulnerability exists in the Azure AD external login flow of Devolutions Server version 2026.3.7.0 and earlier. This flaw allows a remote attacker to take over a user's account by replaying a captured login-session token that is exposed in a redirect URL. The vulnerability has a CVSS score of 6.8, indicating medium severity.

An uninitialized resource vulnerability in the GPU component of Google Chrome on Android versions prior to 155.0.8059.39 allows a remote attacker who has compromised the renderer process to read memory outside the sandbox via a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 4.7.

An out-of-bounds read vulnerability exists in ANGLE component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to read memory outside the sandbox by delivering a crafted HTML page. The vulnerability has a medium severity rating and does not impact integrity or availability, only confidentiality to a limited extent.

A race condition vulnerability exists in the CacheStorage component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by using a specially crafted HTML page. The vulnerability has a medium severity rating.