CVE-2026-107327 is a critical vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.4. It involves missing authorization controls that could allow a remote authenticated attacker to execute arbitrary code. The vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a code injection vulnerability (CWE-94) that allows a remote authenticated attacker to execute arbitrary code. This vulnerability arises from improper control of code generation within the affected versions. The flaw has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
IBM Langflow OSS versions 1.0.0 through 1.12.8 contain a critical code injection vulnerability (CWE-94) that allows remote attackers to execute arbitrary code due to improper control of code generation.
This security update for rsyslog addresses multiple vulnerabilities including remote denial of service, stack overwrite, heap buffer overflow, and arbitrary code execution risks. The flaws involve components such as imptcp regex framing, crafted RFC 5424 messages, RainerScript replace() function, and the omfile dynaFile template. The update also introduces new DTLS modules and various hardening improvements.
A stack-based buffer overflow vulnerability exists in the interactive shell of the xmllint command-line tool used for parsing XML files. This flaw occurs when an overly long command is input without proper size checks, potentially causing the program to crash. Exploitation requires local access and manual interaction with the tool, making it unlikely in typical environments. The impact is limited to availability due to potential crashes, with no known remote exploitation or code execution in common configurations.
Red Hat has released a critical security update for the Eclipse Temurin build of OpenJDK 25 for Windows, version 25.0.5. This update replaces versions 25.0.4 and 25.0.4.1 and includes multiple security and bug fixes addressing numerous vulnerabilities across various components such as TLS, LDAP, HTTP client/server, XML processing, image handling, and certificate validation. The update also distrusts certain intermediate CA certificates due to security concerns. The advisory covers a broad set of CVEs related to enhancements and fixes in cryptographic operations, authentication mechanisms, and processing of various data formats.
Adobe, Veeam, and Juniper Networks have released patches addressing multiple critical vulnerabilities across their products. These flaws include arbitrary code execution, authorization bypasses, and privilege escalation. Adobe fixed 12 vulnerabilities affecting Campaign Classic, Connect, Creative Cloud, and Substance 3D Painter. Veeam patched nine defects in Backup for Microsoft 365, Backup & Replication, Veeam ONE, and Veeam Agent for Linux. Juniper Networks resolved 18 vulnerabilities in Session Smart Router and Session Smart Conductor. None of these vulnerabilities are currently known to be exploited in the wild.
CVE-2026-119050 is a critical unsafe reflection vulnerability in agno-agi's agno product up to version 3.1.11. It allows attackers to supply model-controlled function names to Python's getattr(), enabling invocation of arbitrary pandas functions. This can lead to code execution by calling pandas.read_pickle on attacker-controlled paths or reading local files via other pandas readers.
Apache Qpid Proton C versions through 0.40.0 have a vulnerability in the SASL authentication frame dispatching process. The software incorrectly dispatches AMQP frames that claim to be SASL frames, allowing an authentication bypass. However, no user name is set during this bypass, so the impact depends on how the application handles an unauthenticated state. The issue is fixed in version 0.41.1.
A vulnerability in Apache Qpid Proton C through version 0.40.0 allows a deeply nested message body decoded by pn_message_body() to overflow the stack and cause a crash. The issue is fixed in version 0.41.1.
A vulnerability in Apache Qpid Proton C's OpenSSL TLS implementation causes the APIs pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() to add to rather than replace the default system trust anchors. This behavior can lead to trusting unexpected peer certificates. The issue does not affect the Win32 SChannel TLS implementation. It affects versions through 0.40.0 and is fixed in version 0.41.1.
A critical SQL Injection vulnerability (CVE-2026-115964) exists in StylemixThemes Motors plugin up to version 1.4.126. This vulnerability allows an unauthenticated attacker to perform Blind SQL Injection, potentially leading to high confidentiality impact and partial denial of service.
Yamaha Corporation's wireless LAN router NWR100 contains a critical OS command injection vulnerability. This flaw allows an attacker to execute arbitrary operating system commands by sending a specially crafted request to the device. The vulnerability has a CVSS score of 9.8, indicating a high severity with potential for full system compromise without any required privileges or user interaction.