CVE-2026-12766

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-12765

Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-12763

Langflow is vulnerable to authentication bypass and insufficient session expiration

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-17628

Langflow is affected by improper authentication due to missing password verification in the password reset endpoint

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-65631

erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service

Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the public jose_jwk:from_binary/1 or jose_jwk:from_map/1 API (or the Elixir wrappers JOSE.JWK.from_binary/1 and JOSE.JWK.from_map/1), an RSA private key that supplies d, e, and n but omits all Chinese Remainder Theorem parameters (p, q, dp, dq, qi) is routed into convert_sfm_to_crt/1, which tries to recover the missing primes by factoring the modulus. The three integers are read straight from the base64url input and are never validated as a real RSA key. When the modulus cannot be split into two factors (for example, when it is itself prime), the search loop convert_sfm_to_crt_find_p/6 performs a modular exponentiation over the attacker-sized modulus on every iteration and never succeeds. A single request of a few hundred bytes forces close to one CPU-second of work before an internal one-second watchdog kills the worker, and a larger modulus raises the cost further. By flooding such requests an attacker can saturate every scheduler and deny service, without credentials, a valid RSA key, or any special configuration. This issue affects jose: from 1.7.7 before 1.11.13.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Potatosalad

Products

Jose

CVE-2026-28336

SolarWinds Dameware Command Injection Vulnerability

SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.

CVSS 3.1 · 9.9 Critical EPSS 1.6% KEV · Not listed

Vendors

Solarwinds

Products

Dameware

CVE-2026-28335

SolarWinds Dameware Buffer Overflow Vulnerability

SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is required.

CVSS 3.1 · 8.4 High EPSS 1.0% KEV · Not listed

Vendors

Solarwinds

Products

Dameware

CVE-2026-28327

SolarWinds Dameware DLL Hijacking Vulnerability

SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Dameware

CVE-2026-121578

CVE-2026-121578

Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Amidaware

Products

Tactical Rmm

CVE-2026-121564

Silent loss of messages when merging overlapping chat exports in whatstk

Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() (whatstk/utils/chat_merge.py), reached from BaseChat.merge(), in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was removed, because the merge keeps whole the chat whose first message is oldest and appends from the other only the messages that are strictly newer than the last message of the first. Every message of the second chat that falls inside the date range already covered by the first is therefore discarded. The two chats are compared on their date ranges and not on the identity of the individual messages, so a message held by only one of the two exports is dropped whenever its date falls inside the range of the other, and both branches of _merge_two_chats() behave this way. The merged result is returned without a warning and without a count of what was removed. This results in a merged chat that omits messages the inputs contain, in a library whose documented uses include forensic review and the generation of training data.

CVSS 4.0 · 1.8 Low EPSS < 1% KEV · Not listed

Vendors

Lucasrodes

Products

Whatstk

CVE-2026-121413

Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession

Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the _Session class create class-level permission. Attackers holding a user's session token can send an already revocable token to /upgradeToRevocableSession to obtain additional sessions with fresh expiration that persist after the original session is logged out.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Parse Community Parseplatform

Products

Parse Server Parse-server

CVE-2026-121409

FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token

FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU, or a 240–247 byte token to a FixedTarget freerdp-proxy, triggering a tpdu_write_header assertion that crashes the process.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-121405

FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control

FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRP_MJ_DEVICE_CONTROL request with IOCTL_USBPRINT_GET_1284_ID and a near-maximum length to exhaust client memory.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-119215

AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token. This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Team-alembic

Products

Ash Authentication

CVE-2026-118505

AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource

Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit. The password, magic link and OTP strategies enforce brute_force_strategy by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: mix ash_authentication.install writes sign_in_with_password, request_password_reset_token and request_magic_link, mix ash_authentication.upgrade then adds brute_force_strategy to those strategies, and mix ash_authentication.add_strategy.otp writes its OTP actions without the preparation. Separately, with registration_enabled? true the OTP sign-in is a create action, which preparations do not run on, so brute_force_strategy {:preparation, module} never applied to it. This issue affects ash_authentication: from 5.0.0-rc.4 before 5.0.0-rc.16.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Team-alembic

Products

Ash Authentication

CVE-2026-113937

Out-of-Bounds Read Causing System Crash in macOS Before 27.2

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2026-111211

Potential log injection via unescaped geometry form values

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Django Project Djangoproject

Products

Django Django

CVE-2026-110748

Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files

This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless their paths. It was possible, for example, to specify a path to a local file. However, these files were always expected to be in some specific formats and the reading stops at the first parsing error, which makes this vulnerability unlikely to leak sensitive information. The impacted formats are: * Geographic Markup Language (GML) with `xlink:href` attributes for other files in GML format. * Well Known Text (WKT) with parameter elements for datum shift grids in NADCON, NTv2 or RGF93 formats. * Landsat scene with paths to files for each band in the GeoTIFF format. Users are recommended to upgrade to version 1.7, which fixes the issue by restricting the paths to the same directory as the file containing the references to other files, or to a predetermined directory for datum shift grids.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Sis

CVE-2026-110265

runZero search SQL injection

A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's hosted environment found only testing of the issue and no adversary traffic. This issue was fixed in version 5.1.261013.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Runzero

Products

Platform

CVE-2026-103916

Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory

Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Sandboxes