Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
9.1 CRITICAL
CVE-2026-3627 — Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete informati…

concert | Remote | Injection
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
2.3 LOW
CVE-2026-22056 — CVE-2026-22056 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Websc…

StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulnerability. Successful exploit could allow …

storagegrid storagegrid | Remote | Denial of Service
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
9.9 CRITICAL
CVE-2026-19295 — Langflow is affected by multiple remote code execution vulnerabilities due to insufficien…

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and trigge…

langflow_oss | Remote | Injection
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
6.4 MEDIUM
CVE-2026-19294 — Langflow is affected by multiple authentication bypass, path traversal, authorization, an…

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization.

langflow_oss | Remote | Authorization
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
9.8 CRITICAL
CVE-2026-19286 — Langflow is affected by multiple remote code execution vulnerabilities due to insufficien…

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

langflow_oss | Remote | Authorization
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.2 HIGH
CVE-2026-18904 — Langflow is affected by multiple authentication bypass, path traversal, authorization, an…

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.

langflow_oss | Remote | Information Disclosure
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
7.5 HIGH
CVE-2026-18899 — Langflow is affected by multiple authentication bypass, path traversal, authorization, an…

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.

langflow_oss | Remote | Path Traversal
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.2 HIGH
CVE-2026-18891 — Langflow is affected by multiple authentication bypass, path traversal, authorization, an…

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.

langflow_oss | Remote | Authentication
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.8 HIGH
CVE-2026-18729 — Langflow is affected by multiple remote code execution vulnerabilities due to insufficien…

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

langflow_oss | Remote | Injection
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
4.3 MEDIUM
CVE-2026-18545 — Langflow is affected by multiple authentication bypass, path traversal, authorization, an…

IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading …

langflow_oss | Remote | Server-Side Request Forgery
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
9.9 CRITICAL
CVE-2026-18527 — IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated p…

IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthen…

Remote | Authentication
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
7.5 HIGH
CVE-2026-17203 — IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated p…

IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.

Remote | Authentication
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
7.0 HIGH
CVE-2026-16821 — Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a format string vulnerability.

aix aix powervm_vios | Injection
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
3.7 LOW
CVE-2026-13735 — WireGuard keepalive transport-data messages accepted without Poly1305 authentication

Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_data_message(), any type-4 transport-data message whose payload was exactly 16 by…

zephyr zephyr | Remote | Authentication
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
6.5 MEDIUM
CVE-2026-13734 — Zephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay end…

Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter too late. After AEAD decryption of a MESSAGE_TRAN…

zephyr zephyr | Remote | Race Condition
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
5.9 MEDIUM
CVE-2025-64649 — Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation.

concert | Remote | Authentication
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
5.9 MEDIUM
CVE-2025-36290 — IBM Integrated Analytics System (IIAS) is affected by improper SSL/TLS certificate valida…

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man …

integrated_analytics_system | Remote | Cryptography
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
5.9 MEDIUM
CVE-2025-36271 — IBM Integrated Analytics System (IIAS) is affected by a predictable salt vulnerability in…

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

integrated_analytics_system | Remote | Cryptography
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
6.1 MEDIUM
CVE-2026-82343 — Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-c…

A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads…

enterprise_linux enterprise_linux | Memory Corruption
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
9.8 CRITICAL
CVE-2026-82329 — Potential authentication bypass leading to administrative access in Artifactory

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

artifactory | Remote | Authentication
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
Showing 20 of 12622 Results