VulDB Recent Entries

A vulnerability was found in Apple macOS up to 15.7/26/26.6 and classified as problematic. The impacted element is an unknown function of the component Privacy Preferences. Such manipulation leads to race condition. This vulnerability is traded as CVE-2026-65372. An attack has to be approached locally. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability has been found in Tracer-Cloud OpenSRE up to 0.1.2026.10.19 and classified as very critical. The affected element is the function execution_allowed of the component Headless Presenter. This manipulation causes improper privilege management. This vulnerability appears as CVE-2026-109444. The attack may be initiated remotely. There is no available exploit.

A vulnerability, which was classified as critical, was found in eosphoros-ai DB-GPT up to 0.8.2. Impacted is an unknown function of the file docker-compose.yml. The manipulation results in hard-coded credentials. This vulnerability is reported as CVE-2026-77933. The attack can be launched remotely. No exploit exists.

A vulnerability, which was classified as problematic, has been found in ginlix-ai LangAlpha up to 2026.09.07. This issue affects the function require_workspace_owner of the component Sandbox Container. The manipulation leads to improper privilege management. This vulnerability is documented as CVE-2026-109441. The attack can be initiated remotely. There is not any exploit available.

A vulnerability classified as critical was found in Ning compress-lzf up to 1.1.x. This vulnerability affects unknown code of the component UnsafeChunkDecoder. Executing a manipulation can lead to out-of-bounds read. This vulnerability is registered as CVE-2026-109395. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

A vulnerability classified as very critical has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. This affects an unknown part of the file /tools/call of the component Tool Call Handler. Performing a manipulation results in os command injection. This vulnerability is cataloged as CVE-2026-75128. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability described as critical has been identified in cas-bigdatalab piflow up to 2.0.1. Affected by this issue is the function subprocess.run of the component DeepAgents. Such manipulation leads to os command injection. This vulnerability is listed as CVE-2026-109442. The attack may be performed from remote. There is no available exploit.

A vulnerability marked as problematic has been reported in Cloudflare pingora up to 0.8.0. Affected by this vulnerability is the function pingora_core::protocols::http::v2::server::default_h2_options of the component HTTP2 Server. This manipulation of the argument max_header_list_size/max_concurrent_streams causes allocation of resources. This vulnerability is tracked as CVE-2026-105297. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability labeled as very critical has been found in Cloudflare Pingora up to 0.8.x. Affected is the function req_header of the component HTTP2 Proxy. The manipulation of the argument Host results in improper access controls. This vulnerability is identified as CVE-2026-105298. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

A vulnerability identified as critical has been detected in apconw Aix-DB up to 1.2.4. This impacts an unknown function of the file /dify/get_answer of the component Deepagents Execute Tool. The manipulation leads to os command injection. This vulnerability is referenced as CVE-2026-77926. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability categorized as critical has been discovered in ginlix-ai LangAlpha up to 2026.09.07. This affects the function ExecuteCode of the file _internal/.vault_secrets.json of the component Bash. Executing a manipulation can lead to injection. The identification of this vulnerability is CVE-2026-109440. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in jd-opensource JoySafeter up to 1.0.0. It has been rated as critical. The impacted element is the function subprocess.run of the file chat.start of the component Execute Tool. Performing a manipulation of the argument shell results in sandbox issue. This vulnerability was named CVE-2026-109443. The attack may be initiated remotely. There is no available exploit.

A vulnerability was found in eosphoros-ai DB-GPT up to 0.8.2. It has been declared as very critical. The affected element is the function get_user_from_headers of the file /api/v1/chat/react-agent of the component ReAct Agent. Such manipulation leads to improper privilege management. This vulnerability is uniquely identified as CVE-2026-77932. The attack can be launched remotely. No exploit exists.

A vulnerability was found in IBM TRIRIGA Application Platform up to 5.0.8. It has been classified as critical. Impacted is an unknown function. This manipulation causes improper authentication. This vulnerability is handled as CVE-2026-107400. The attack can be initiated remotely. There is not any exploit available.

A vulnerability was found in IBM Langflow OSS up to 1.12.4 and classified as critical. This issue affects some unknown processing. The manipulation results in improper privilege management. This vulnerability is known as CVE-2026-107366. It is possible to launch the attack remotely. No exploit is available.

A vulnerability has been found in IBM Sterling Connect Direct for Unix up to 6.3.0.7/6.4.0.6 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improper privilege management. This vulnerability is traded as CVE-2026-105453. An attack has to be approached locally. There is no exploit available.

A vulnerability, which was classified as problematic, was found in IBM ContextForge MCP Gateway up to 1.0.5. This affects an unknown part of the component OAuth Configuration. Executing a manipulation of the argument oauth_config.token_url can lead to server-side request forgery. This vulnerability appears as CVE-2026-8355. The attack may be performed from remote. There is no available exploit.

A vulnerability, which was classified as very critical, has been found in IBM Verify Identity Access and Security Verify Access 11.0.3.1/10.0.9.3. Affected by this issue is some unknown functionality. Performing a manipulation results in hard-coded credentials. This vulnerability is reported as CVE-2026-109126. The attack requires a local approach. No exploit exists.

A vulnerability classified as critical was found in ZephyrProject Zephyr up to 4.4.2. Affected by this vulnerability is the function hfp_hf_disconnected of the file subsys/bluetooth/host/classic/hfp_hf.c of the component Bluetooth HFP Host. Such manipulation leads to resource consumption. This vulnerability is documented as CVE-2026-77684. The attack can be executed remotely. There is not any exploit available.

A vulnerability classified as critical has been found in MLflow up to 3.17.1. Affected is the function FileStore.start_trace of the file trace_info.yaml of the component FileStore. This manipulation of the argument trace_id causes path traversal. This vulnerability is registered as CVE-2026-53995. Remote exploitation of the attack is possible. No exploit is available.