IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a missing authorization vulnerability (CWE-862) that allows a remote attacker with low-privileged authenticated access to bypass administrator-only restrictions and execute arbitrary code on the server by manipulating a built-in code-execution component.
IBM Langflow OSS versions 1.0.0 through 1.12.4 store sensitive information in cleartext, which could allow a remote authenticated attacker to access this information. The vulnerability is identified as CWE-312 and has a medium severity with a CVSS score of 6.5. No public exploits or patches are currently documented.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain an improper authentication vulnerability that could allow a remote attacker to obtain sensitive information without authorization. This vulnerability does not require user interaction or privileges to exploit and impacts confidentiality.
The npm package @jasperquinn/postcss-motion-helpers contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be considered exposed and require immediate rotation from a different, uncompromised machine. Removing the package alone may not eliminate the malicious presence, as the attacker may have established persistent control.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.
CVE-2026-96199 is a heap-based buffer overflow vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. Microsoft has released an official fix in version 154.0.4258.37 to address this issue.
CVE-2026-96198 is a heap-based buffer overflow vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. Microsoft has released an official fix in version 154.0.4258.37 to address this issue.
CVE-2026-85897 is a heap-based buffer overflow vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. Microsoft has released an official fix in version 154.0.4258.37 to address this issue. The vulnerability has a high severity rating with a CVSS score of 8.8. No known exploits are reported in the wild at this time.
CVE-2026-85890 is a high-severity double free vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. An official fix is available in version 154.0.4258.37.
CVE-2026-106036 is a vulnerability in Krajowa Izba Rozliczeniowa's Szafir application where it improperly validates SSL/TLS certificates. The application accepts any client or server certificate without verifying the certificate or hostname, allowing HTTPS connections without authenticating the remote server. This flaw enables an attacker to present an arbitrary SSL/TLS certificate and potentially cause the application to download malicious update files from an attacker-controlled server. The issue was fixed in Szafir version 2.0 build 708.
Szafir, a product by Krajowa Izba Rozliczeniowa, has a path traversal vulnerability in the handling of uploaded filenames. An attacker capable of intercepting and redirecting update requests can craft an arbitrary XML file that the system saves to a location chosen by the attacker. This vulnerability is identified as CWE-22 and was fixed in version 2.0 build 708. The CVSS 4.0 score is low (2.3), reflecting limited impact and attack complexity.
Szafir and Szafir Weryfikująca products from Krajowa Izba Rozliczeniowa are affected by an XML External Entity (XXE) vulnerability (CWE-611). This flaw allows an attacker to craft XML files with external DTD references that, when processed by the vulnerable XML parser during signing or verification, can lead to arbitrary file disclosure from the victim's filesystem. The vulnerability has been fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported and remains vulnerable.
Red Hat has released a security update for the Red Hat build of MicroShift 4.19.53, a lightweight Kubernetes orchestration solution for edge deployments. This update addresses multiple vulnerabilities in underlying Golang components, including denial of service via excessive recursion and malicious MIME headers, cross-site scripting, denial of service from URL path resolution complexity, indefinite TLS KeyUpdate messages, and man-in-the-middle attacks via untrusted intermediate certificates. Users of MicroShift 4.19 are advised to apply the updated RPM packages and container images when available.
CVE-2026-42694 is a medium-severity vulnerability in Themeum Kirki up to version 6.4.0 that allows improper neutralization of script-related HTML tags, leading to basic cross-site scripting (XSS). This flaw enables code injection via crafted input. The issue is fixed in version 6.4.1.
Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0.
Red Hat has issued a security update for its build of MicroShift 4.20.44, a lightweight Kubernetes orchestration solution for edge device deployments. The update addresses a vulnerability in the golang crypto/x509 package (CVE-2026-111943) that could allow man-in-the-middle attacks via untrusted intermediate certificates. Users of Red Hat build of MicroShift 4.20 are advised to apply the updated RPM packages and container images when available.
CVE-2026-116848 is a stored cross-site scripting (XSS) vulnerability in The Plus Addons for Elementor Page Builder Lite by POSIMYTH Innovations. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. Versions from initial release up to 6.5.3 are affected. The issue is fixed in version 6.6.0.
CVE-2026-109891 is a missing authorization vulnerability in the Happy Addons for Elementor plugin by weDevs. It affects versions from the initial release up to 3.50.1. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized access. The issue has been fixed in version 3.51.0.