CVE-2026-13781 — Critical vulnerability brief
Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer…
Tag: critical
CVE-2026-7663 — Critical vulnerability brief
IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to…
CVE-2026-14241 — Critical vulnerability brief
Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough…
CVE-2026-11720 — Critical vulnerability brief
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes…
CVE-2026-31928 — Critical vulnerability brief
The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed…
CVE-2026-54350 — Critical vulnerability brief
Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the…
CVE-2026-54636 — Critical vulnerability brief
Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running…
CVE-2026-48930 — Critical vulnerability brief
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in…
CVE-2025-71333 — Critical vulnerability brief
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can…
CVE-2025-71338 — Critical vulnerability brief
Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers…