CVE Vulnerability Catalog

IBM Langflow OSS versions 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system.

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

The Happy Addons for Elementor plugin in versions up to 3.50.1 contains a missing authorization vulnerability due to incorrectly configured access control security levels. This may allow exploitation of misconfigured security mechanisms.

Chained Quiz plugin versions up to and including 1.4.1 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the user's browser.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.

IBM Langflow OSS versions 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability due to improper neutralization of special elements used in OS commands. A remote authenticated attacker could exploit this to execute arbitrary code.

USP Ultimate Screenshot Painter versionCode 240213.009 has insecure permissions that allow unauthorized attackers to move or overwrite files in another user's private storage by supplying a crafted content URI.

The FeatureActionActivity component of Oasis Feng Island versionCode 51801 has insecure permissions, allowing unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS).

MBasov OMN-Go versionCode 26080824 has insecure permissions that allow unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

The ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 has insecure permissions, allowing unauthorized attackers to arbitrarily force a device reset or Denial of Service (DoS).

Yet Another UPnP Controller versionCode 50200 has insecure permissions that allow unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.

The NotificationHelper component of NoNonsense Notes versionCode 72600 has insecure permissions, allowing unauthorized attackers to write in another user's notes by supplying a note id.

Mission Control / AIMSICD versionCode 2026080501 has insecure permissions that allow unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application.

The object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 has insecure permissions, allowing unauthorized attackers to arbitrarily write content into another user's private storage via a crafted payload.

LeafPad / Leaf Note v1.21 (versionCode 21) has insecure permissions that allow unauthorized attackers to arbitrarily read another user's note data.

The MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) has insecure permissions, allowing unauthorized attackers to arbitrarily read and modify another user's task database.

Bulk Share : Location Sender v2.1.0 has insecure permissions that allow unauthorized attackers to invoke an exported component. This leads to arbitrary data access and control of data flow.

The craftxbox YubiClip XOR fork v1.0.1 has insecure permissions that allow unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism. This causes a desynchronization of the timing.