Tagged “cve.org”
CVEs tagged cve.org, newest first.
47177 CVEsRSS
CVE-2026-111734High· 7.1Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()
P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame co…
CVE-2026-111733High· 8.7NULL pointer dereference on implicit read of AR specific record index
P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR (AR specific indices 0xE000-0xEFFF, and the expected identification data of a …
CVE-2026-107038Critical· 9.1PoCInsecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.
Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.
CVE-2026-107036Medium· 5.1Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application.
Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application.
CVE-2026-111732Critical· 9.3Out-of-bounds write when parsing AR Vendor Block requests
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-siz…
CVE-2026-111731High· 8.7Infinite loop when reading PDPortDataCheck record of subslot 0
P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The loop over the ports never advanced to the next port, so the request never completes and the device …
CVE-2026-107035Medium· 6.5PoCInsecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into another user's private storage via a crafted payload.
Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into another user's private storage via a crafted payload.
CVE-2026-111730High· 7.2Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length
P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) was used to copy data into the 241-byte peer station name buffer and to place the terminating…
CVE-2026-112255Low· 2.9Endpoint credential minting (insecure default allow-list)
Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 th…
CVE-2026-107033Medium· 6.5PoCInsecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database.
Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database.
CVE-2026-107030High· 7.5Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a desynchronization of the timing.
Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a desynchronization of the timing.
CVE-2026-77819Medium· 6.5Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory.
CVE-2026-66912Medium· 5.3Stored Cross-Site Scripting in Zimbra
Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email contai…
CVE-2026-66911Medium· 5.3Stored Cross-Site Scripting in Zimbra
Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthentica…
CVE-2026-107029Critical· 9.1PoCInsecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.
Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.
CVE-2026-77817Medium· 6.5Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.
CVE-2026-104310Medium· 4.3Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.
CVE-2026-104308Medium· 4.3Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command.
CVE-2026-102590Medium· 5.0Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.
CVE-2026-104315Medium· 4.3Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating…
CVE-2026-104312Low· 3.5Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim u…
CVE-2026-106036Medium· 6.9Improper certificate validation in Szafir
Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cau…
CVE-2026-110192Medium· 6.5Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.
CVE-2026-104331Medium· 5.4Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating…
CVE-2026-110200Medium· 6.5PoCLangflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information.
CVE-2026-107025High· 7.5Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.
Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.
CVE-2026-110245High· 7.5Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication.
CVE-2026-93571Low· 2.3Path Traversal in Szafir
Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that will be saved in location chosen by attacker. This issue …
CVE-2026-93570High· 8.2XML External Entity injection in Szafir and Szafir Weryfikująca
Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing …
CVE-2026-107027Critical· 9.1PoCInsecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.
Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.