Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-70431 — Jenkins Multijob Plugin Arbitrary Code Execution Vulnerability

Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure per…

| Misconfiguration
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70430 — Jenkins Arbitrary Object Instantiation Vulnerability

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overal…

| Misconfiguration
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70429 — Jenkins User Impersonation via Case-Insensitivity Vulnerability

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-…

| Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70428 — Jenkins Path Traversal Vulnerability

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission…

| Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70427 — Jenkins Arbitrary File Write Vulnerability

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able t…

| Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70426 — Jenkins Remoting Deserialization Filter Bypass

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved…

| Information Disclosure
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.1 HIGH
CVE-2026-9081 — Langflow OSS is affected by server-side request forgery in provider validation and API re…

IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the validate_model_provider_key() function for the Ollama provider. The …

langflow_oss | Remote | Server-Side Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.5 MEDIUM
CVE-2026-7657 — Langflow OSS is affected by server-side request forgery in provider validation and API re…

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery (SSRF) due to incomplete and ineffective SSRF protection enforcement.

langflow_oss | Remote | Server-Side Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70609 — Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools…

| Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
5.5 MEDIUM
CVE-2026-44605 — Rpm: heap buffer overflow in ndb slot table parsing

A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from…

Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70608 — Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL naviga…

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword coul…

| Misconfiguration
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.2 HIGH
CVE-2026-17625 — Langflow is affected by OS Command Injection in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote auth…

langflow_oss | Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.5 HIGH
CVE-2026-9077 — Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Prot…

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on …

langflow_oss | Remote | Misconfiguration
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.5 HIGH
CVE-2026-8446 — Langflow is affected by security vulnerabilities in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are co…

langflow_oss | Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.5 MEDIUM
CVE-2026-7646 — Langflow is affected by security vulnerabilities in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and proc…

langflow_oss | Remote | Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
5.3 MEDIUM
CVE-2026-70607 — Electron: window.open features string controls some window options considered privileged

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content…

Remote | Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.7 HIGH
CVE-2026-20313 — Cisco Catalyst SD-WAN Security Hardening Release - Memory Corruption Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulte…

catalyst_sd-wan_manager | Remote | Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.8 HIGH
CVE-2026-20312 — Cisco Catalyst SD-WAN Security Hardening Release - Information Disclosure Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulte…

catalyst_sd-wan_manager | Remote | Cryptography
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.3 MEDIUM
CVE-2026-20311 — Cisco IOS XE Software Web UI Denial of Service Vulnerability

A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condition on an aff…

Remote | Denial of Service
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
9.1 CRITICAL
CVE-2026-20310 — Cisco SD-WAN Software Security Hardening Release - Improper Link Resolution Before File A…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulte…

catalyst_sd-wan_manager | Remote | Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
Showing 20 of 9823 Results