Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.7 HIGH
CVE-2026-68746 — Livebook Teams identity check fails open when the deployment group is unresolvable, allow…

Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Liveboo…

Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.8 MEDIUM
CVE-2026-66885 — Livebook Teams identity callback lacks state binding, allowing login CSRF

Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook…

Remote | Cross-Site Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.0 HIGH
CVE-2026-66881 — Path traversal in imported file_entries name allows arbitrary file write via URL-type ent…

Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path. A .livemd notebook can decl…

Remote | Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.6 HIGH
CVE-2026-66298 — JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global sho…

Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and run…

Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
5.0 MEDIUM
CVE-2026-66297 — Unescaped deployment environment variables in generated setup commands

Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. Liv…

Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.5 HIGH
CVE-2026-55524 — PraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then…

PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool…

Remote | Server-Side Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.7 HIGH
CVE-2026-55523 — PraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targets

PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.web_crawl_tools.web_crawl() function is vulnerable to server-side request forgery. While it vali…

Remote | Server-Side Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.8 HIGH
CVE-2026-55522 — PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe…

PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution…

| Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
5.4 MEDIUM
CVE-2026-21766 — HCL Digital Experience and Digital Experience Compose insufficiently protects credentials

The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials.  Under certain very specific use cases and specific configurations, sensitive i…

Remote | Information Disclosure
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.5 HIGH
CVE-2026-18958 — imranrisal-dev Student-Management-System Login loginCheckTest.php sql injection

A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Affected by this vulnerability is an unknow…

Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
5.5 MEDIUM
CVE-2026-18954 — Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MC…

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on th…

| Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.6 HIGH
CVE-2026-18953 — Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server

Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbi…

| Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.8 HIGH
CVE-2026-17556 — Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance s…

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user…

enterprise_server | Remote | Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.4 HIGH
CVE-2026-9205 — Langflow is affected by weaknesses in secret handling and sensitive configuration access

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.

langflow_oss | Remote | Cryptography
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.8 HIGH
CVE-2026-9201 — Langflow OSS is affected by arbitrary code execution in component generation, validation,…

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component validation mechanism. When the optional h…

langflow_oss | Remote | Cryptography
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.1 HIGH
CVE-2026-9196 — Langflow OSS is affected by arbitrary code execution in component generation, validation,…

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The ap…

langflow_oss | Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.1 HIGH
CVE-2026-9130 — Langflow OSS is affected by arbitrary code execution in custom component validation and t…

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collisi…

langflow_oss | Remote | Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.8 HIGH
CVE-2026-8478 — Langflow OSS is affected by arbitrary code execution in component generation, validation,…

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

langflow_oss | Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.4 HIGH
CVE-2026-8470 — Langflow is affected by weaknesses in secret handling and sensitive configuration access

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from use…

langflow_oss | Remote | Cryptography
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.7 HIGH
CVE-2026-8183 — Langflow OSS is affected by arbitrary code execution in custom component validation and t…

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote attacker to traverse direc…

langflow_oss | Remote | Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
Showing 20 of 9799 Results