Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.
This issue affects N-central: through 2026.1.
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.
This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.
Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
CVE-2026-20316 is a vulnerability in Cisco Secure Firewall Management Center (FMC) software where a hard-coded, static password exists for a low-privileged account in the web interface. This allows an unauthenticated remote attacker to log in to the affected system using these credentials and access sensitive data. The vulnerability is rated as medium severity by CVSS but Cisco assigns a high security impact rating due to potential privilege escalation when combined with other vulnerabilities. The attack surface is reduced if the FMC management interface is not exposed to the public internet. Multiple versions of Cisco Secure FMC are affected.
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
This functionality was intended to be for internal use only and is not intended to be remotely accessible.
Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out.
This issue was discovered externally and is known to be actively exploited.
CVE-2023-4346 is a vulnerability in the KNX Association's KNX Protocol Connection Authorization Option 1, involving an overly restrictive account lockout mechanism. This flaw could allow an attacker to purge all devices that do not have additional security options enabled and set a BCU key to lock the device. The vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
CVE-2026-0770 is a critical vulnerability in Langflow that allows remote attackers to execute arbitrary code by including functionality from an untrusted control sphere. This vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector, no required privileges or user interaction, and impacts confidentiality, integrity, and availability. It is known to be exploited in the wild. No specific affected versions or patches are currently provided.
CVE-2026-63030 is a critical vulnerability in WordPress Core involving an interpretation conflict that enables attackers to perform SQL Injection and potentially achieve Remote Code Execution. It can be chained with another vulnerability, CVE-2026-60137, to escalate impact. The vulnerability has a high CVSS score of 9.8 and is known to be exploited in the wild.
DD-WRT contains a stack-based buffer overflow vulnerability in its UPnP implementation that allows unauthenticated attackers to overflow an internal buffer and potentially execute arbitrary code. This vulnerability has been exploited in the wild. No specific affected versions or patches are provided in the available data.