Threat database

Langflow versions prior to 1.10.0 contain a remote code execution (RCE) vulnerability identified as CVE-2026-9198. An exploit exists that leverages an API endpoint to obtain a superuser token and then executes arbitrary code on the target system. The exploit has been tested on Ubuntu 22.04.

Ghost_CMS versions from 0.7.2 up to and including 6.19.0 are affected by a remote code execution vulnerability identified as CVE-2026-29053. This vulnerability allows an attacker to execute arbitrary code remotely on affected systems. The issue is classified as critical severity. No patch or remediation information is provided in the available data. Exploit code is publicly known and categorized as an exploit. The affected platforms include Ubuntu 18.0.4 and Windows 10.

PodcastGenerator version 3.2.9 contains a stored Cross-Site Scripting (XSS) vulnerability in its Live Items functionality. An authenticated administrator can inject malicious JavaScript code into the TITLE, SHORT DESCRIPTION, or LONG DESCRIPTION fields of a Live Item. This payload is stored and executed when the Live Item is viewed both in the administrative interface and on the public Live Stream page. While administrative privileges are required to inject the payload, any unauthenticated user visiting the public Live Stream page can trigger the stored script execution.

A denial of service (DoS) vulnerability has been identified in EVerest version 2025.9.0. This issue could potentially allow an attacker to disrupt the availability of the affected software. No detailed technical information or exploit code is provided.

EasyAppointments version 1.5.1 is affected by a blind SQL injection vulnerability. This flaw allows an attacker to execute unauthorized SQL queries on the backend database without direct feedback, potentially leading to data exposure or manipulation. The vulnerability specifically impacts versions up to and including 1.5.1.

miniOrange version 5.4.3 contains an unauthenticated authentication bypass vulnerability. This flaw allows attackers to bypass authentication mechanisms without valid credentials, potentially gaining unauthorized access. The issue affects versions up to and including 5.4.3. No patch or remediation details are provided in the available data. The severity is assessed as critical due to the nature of authentication bypass.

A remote code execution (RCE) vulnerability has been identified in Grav CMS version 2.0.7. This vulnerability allows an attacker to execute arbitrary code on the affected system. No specific technical details or patch information are provided.

Payload CMS versions prior to 3.73.0 contain a blind SQL injection vulnerability in the processing of 'where' filters on JSON or RichText fields using the Drizzle database adapters. This vulnerability allows attacker-controlled JSON filter input to manipulate generated JSONPath expressions, potentially exposing sensitive data. Exploit code is publicly available demonstrating this issue on Payload CMS 3.72.0 with PostgreSQL 15.

Wolf CMS version 0.8.3.1 is affected by a remote code execution (RCE) vulnerability. This allows an attacker to execute arbitrary code on the affected system remotely. The vulnerability is critical in severity and affects versions up to and including 0.8.3.1.

Langflow version 1.8.4 contains a critical vulnerability that allows path traversal leading to remote code execution (RCE). This flaw enables an attacker to execute arbitrary code on the affected system by exploiting improper handling of file paths.

An unauthenticated OS command injection vulnerability affects Linksys E1200 firmware versions 2.0.02 and 2.0.04 when directly connected to the LAN. This vulnerability allows an attacker to execute arbitrary operating system commands without authentication.

NanaZip version 6.5 is affected by a denial-of-service (DoS) vulnerability. The issue allows an attacker to disrupt normal operation of the software, potentially causing it to crash or become unresponsive. No specific technical details or exploitation methods are provided.

A buffer overflow vulnerability exists in PCMan version 2.0.7. This vulnerability affects Windows XP Professional Service Pack 2 and Service Pack 3 environments. Exploit code is known but there is no indication of active exploitation in the wild. The severity is assessed as medium based on available information.

CVE-2026-43945 is a reported vulnerability with no additional technical details or impact information provided.

CVE-2026-8169 is a published vulnerability with no detailed public description or technical information available. There is no CVSS score or known exploit activity reported.

CVE-2026-63734 is a reported vulnerability with no additional technical details or impact information provided. There is no information on affected software versions or exploitation status.

CVE-2026-8481 is a published vulnerability with no detailed public description or technical details available. There is no information on affected versions, exploit status, or impact severity.

CVE-2026-8476 is a published vulnerability with no additional technical details or impact information provided.

CVE-2026-7754 is a published vulnerability with no detailed public description or technical details available. No affected versions or patch information have been provided.

CVE-2026-7667 is a published vulnerability with no detailed public description or technical details available. There is no information on affected versions, impact, or exploitation status.