CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs.
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server.
Chained Quiz plugin versions up to and including 1.4.1 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the user's browser.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability due to improper neutralization of special elements used in OS commands. A remote authenticated attacker could exploit this to execute arbitrary code.
USP Ultimate Screenshot Painter versionCode 240213.009 has insecure permissions that allow unauthorized attackers to move or overwrite files in another user's private storage by supplying a crafted content URI.
The FeatureActionActivity component of Oasis Feng Island versionCode 51801 has insecure permissions, allowing unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS).
The ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 has insecure permissions, allowing unauthorized attackers to arbitrarily force a device reset or Denial of Service (DoS).
The NotificationHelper component of NoNonsense Notes versionCode 72600 has insecure permissions, allowing unauthorized attackers to write in another user's notes by supplying a note id.
The craftxbox YubiClip XOR fork v1.0.1 has insecure permissions that allow unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism. This causes a desynchronization of the timing.
Share to Clipboard v1.14.1 has insecure permissions that allow unauthorized attackers to arbitrarily overwrite another user's clipboard content.
The vulnerability involves insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300). Unauthorized attackers can export the application's data.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability due to improper neutralization of special elements used in OS commands. A remote authenticated attacker could exploit this to execute arbitrary code.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability due to deserialization of untrusted data. A remote authenticated attacker could exploit this to execute arbitrary code.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability due to deserialization of untrusted data. A remote attacker who can reach the message broker could exploit this to execute arbitrary code on the system.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability due to improper access control. A remote authenticated attacker could exploit this to execute arbitrary SQL commands.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability due to improper neutralization of special elements used in code. A remote authenticated attacker could exploit this to execute arbitrary code.
Improper Link Resolution Before File Access (CWE-59) in Elastic Cloud Enterprise (ECE) allows a symlink attack (CAPEC-132). This can lead to unauthorized read and write access to data of other deployments on the same host.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS