IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows remote attackers who can access the message broker to execute arbitrary code via deserialization of untrusted data. This flaw is identified as CWE-502 and has a high severity score of 8.1. The vulnerability requires network access with high attack complexity and no privileges or user interaction. No public exploits or patches are currently documented.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code via deserialization of untrusted data. This flaw is identified as CWE-502 and has a high severity with a CVSS score of 8.8. The vulnerability requires authentication but no user interaction and impacts confidentiality, integrity, and availability.
An insecure permissions vulnerability in WikiAndPad alpha/beta version 0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.
A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host device.
CVE-2026-118773 is a medium severity vulnerability in the isaacs node-glob package affecting versions from 9.0.0 up to but not including 14.0.2. The flaw involves uncontrolled resource consumption due to improper handling of abort signals during file pattern matching and directory traversal. This can lead to excessive filesystem operations and CPU usage, potentially degrading service availability. The issue does not impact confidentiality or integrity. It is fixed in version 14.0.2.
A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device.
A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop for macOS to obtain information about the host device.
CVE-2026-41216 is a high-severity vulnerability in vtk version 9.6 involving an expired pointer dereference in the vtkPNGReader::ExecuteInformation function. A specially crafted PNG file can trigger this flaw, causing a denial of service by crashing the application. No confidentiality or integrity impact is reported.
CVE-2026-42057 is a high-severity vulnerability in vtk version 9.6 involving an expired pointer dereference in the vtkPNGReader::vtkPNGReaderUpdate2 function. A specially crafted PNG file can trigger this flaw, causing a denial of service by crashing the application. No confidentiality or integrity impact is reported. There is no indication of public exploits or active exploitation in the wild. No patch information is provided in the available data.
CVE-2026-8822 is a high-severity memory corruption vulnerability in the vtkDEMReader ReadProfiles functionality of vtk version 9.6.1. It arises from an out-of-bounds write triggered by processing a specially crafted USGS DEM file, potentially causing a buffer overflow. This flaw allows an attacker to cause a denial of service by crashing the application. No public exploit or known active exploitation is reported. No patch or remediation information is currently available.
CVE-2026-8824 is a high-severity memory corruption vulnerability in vtk version 9.6.1. It affects the vtkBMPReader component's ExecuteDataWithInformation function, where processing a specially crafted BMP file can cause a buffer overflow. This vulnerability could lead to denial of service due to application crash or instability.
CVE-2026-9535 is an out-of-bounds read vulnerability in the vtkChacoReader InputGraph2 functionality of vtk version 9.6.1. This flaw can be triggered by processing a specially crafted chaco file, potentially leading to a read outside the intended memory bounds. The vulnerability has a high severity rating with a CVSS score of 8.2.
CVE-2026-9536 is a heap-based buffer overflow vulnerability in the vtkWindBladeReader FindVariableOffsets functionality of vtk version 9.6.1. This flaw can be triggered by processing a specially crafted .wind file, potentially causing a buffer overflow condition. The vulnerability has a high severity score of 7.5 and does not require user interaction or privileges to exploit.
A vulnerability in the hapijs joi JavaScript data validator affects versions from 16.0.0 up to 17.1.1 and 18.0.0 up to but not including 18.3.1. The Joi.string().email({ multiple: true }) rule uses a regular expression with inefficient complexity, causing the Node.js event loop to be blocked for seconds when processing attacker-controlled input with long whitespace runs. This can lead to denial of service by blocking other operations. The issue is fixed in version 18.3.1.
HashiCorp Nomad and Nomad Enterprise contain a vulnerability (CVE-2026-119168) involving symlink following during same-client allocation data migration. This flaw allows a malicious workload to alter permissions and ownership of host directories, potentially enabling unauthorized access or modification of host files and privilege escalation. The issue is fixed in Nomad versions 2.1.0, 1.11.12, and 1.10.18.
HashiCorp Nomad and Nomad Enterprise contain a vulnerability (CVE-2026-107347) involving improper symlink resolution during dispatch payload and executor log writes. This flaw allows a malicious workload to modify files outside its allocation directory. If the Nomad client agent runs with root privileges, exploitation could lead to root code execution on the host. The issue is fixed in Nomad versions 2.1.0, 1.11.12, and 1.10.18.
HashiCorp Nomad and Nomad Enterprise contain an authorization bypass vulnerability (CVE-2026-102260) affecting several read-only API endpoints. This flaw allows an authenticated user with read permissions in one namespace to access information about objects in other namespaces. The issue is fixed in Nomad Community Edition 2.1.0 and Nomad Enterprise versions 2.1.0, 1.11.12, and 1.10.18.
Critical9.2KEVMirageEPSS 99%Palo Alto Unit 42CVE-2026-109618
Two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP. These flaws involve improper memory handling during fatal error processing with longjmp(), allowing attackers to execute arbitrary code remotely. CVE-2026-109618 arises from uninitialized request memory after out-of-memory errors, while CVE-2026-109619 involves global memory pointing to freed regions exploitable in subsequent requests. Over 22.6 million exposed instances have been identified. Palo Alto Networks provides protections via multiple security products and recommends immediate patching. At least one European government took precautionary measures by taking its website offline. Users should consult the PHP Group’s security advisory for patching guidance.
Cisco Talos has identified a new Windows-based command-and-control (C2) framework named NIK C2 that integrates AI directly into its attack chain. This Go-based implant enables adversaries to dump credentials, capture keystrokes, and deploy screen-locking ransomware. It uses an embedded OpenAI model to analyze harvested data in real time, funding API requests by hijacking the victim's own OpenAI API keys. This integration allows continuous data collection and exploitation without offline delays, turning compromised hosts into active operational assets. The use of victim API keys also masks attacker infrastructure, complicating detection and incident response. Defenders are advised to implement continuous behavioral monitoring and update endpoint defenses accordingly.