{"vulnerability": "CVE-2026-1056", "sightings": [{"uuid": "fc197695-4315-44de-9974-e817fba9c87d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1056", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/115980456736557020", "content": "", "creation_timestamp": "2026-01-29T21:15:25.782383Z"}, {"uuid": "095d504c-5d8c-4524-9b1f-c1389b8b8549", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1056", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mdiggqeliv27", "content": "", "creation_timestamp": "2026-01-28T13:55:57.871852Z"}, {"uuid": "edc831fe-8f91-4a26-8e43-2dffe30b6e4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1056", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mdigsfe4h32t", "content": "", "creation_timestamp": "2026-01-28T14:02:28.117776Z"}, {"uuid": "9356ca1d-6b43-418f-8da9-3506ed8534b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10565", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnbte57hj322", "content": "CVE-2026-10565 - Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition\nCVE ID : CVE-2026-10565\n \n Published : June 2, 2026, 3:16 a.m. | 1\u00a0hour, 16\u00a0minutes ago\n \n Description : A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is t...", "creation_timestamp": "2026-06-02T05:10:26.907416Z"}, {"uuid": "a1c6bb3f-7dbb-45e5-a58b-405e3c9d3694", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10568", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnbturbbnw2v", "content": "CVE-2026-10568 - itsourcecode Fees Management System manage_payment.php sql injection\nCVE ID : CVE-2026-10568\n \n Published : June 2, 2026, 3:16 a.m. | 1\u00a0hour, 16\u00a0minutes ago\n \n Description : A vulnerability was detected in itsourcecode Fees Management System 1.0. Affected is a...", "creation_timestamp": "2026-06-02T05:19:44.696274Z"}, {"uuid": "ef9ad268-384c-41eb-a305-6ff5efea93a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10566", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnbupmoxoy2b", "content": "CVE-2026-10566 - FoundationAgents MetaGPT schema.py Message.check_instruct_content deserialization\nCVE ID : CVE-2026-10566\n \n Published : June 2, 2026, 3:16 a.m. | 1\u00a0hour, 16\u00a0minutes ago\n \n Description : A weakness has been identified in FoundationAgents MetaGPT up to 0.8.2. T...", "creation_timestamp": "2026-06-02T05:36:26.542402Z"}, {"uuid": "116ff010-4d28-44d2-8012-f8f3f4a3de85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10567", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnbuyl7os72v", "content": "CVE-2026-10567 - 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting\nCVE ID : CVE-2026-10567\n \n Published : June 2, 2026, 3:16 a.m. | 1\u00a0hour, 16\u00a0minutes ago\n \n Description : A security vulnerability has been detected in 1Panel-dev CordysC...", "creation_timestamp": "2026-06-02T05:39:46.699255Z"}, {"uuid": "6d3a191d-11c8-49bb-bf00-0334554ac054", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10561", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116794133423406732", "content": "A new vulnerability with increased severity was disclosed for IBM Langflow OSS (CVE-2026-10561) https://vuldb.com/vuln/372672", "creation_timestamp": "2026-06-22T14:04:10.819432Z"}, {"uuid": "bda7b1c6-0e9d-43f5-9fb2-c9d5db2ee5d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-10561", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116794354131566974", "content": "IBM Langflow OSS v1.0.0 \u2013 1.9.3 hit by CRITICAL code injection (CVE-2026-10561, CVSS 10). Auth bypass enables unauth'd RCE & total compromise. No patch yet \u2014 track IBM advisories for updates. https://radar.offseq.com/threat/cve-2026-10561-cwe-94-improper-control-of-generati-066ce4d0e72e70d2 #OffSeq #Infosec #CVE202610561", "creation_timestamp": "2026-06-22T15:00:15.139173Z"}, {"uuid": "4a41ff7b-4053-4ecd-916a-dec10509cf77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-10561", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mov5n7s5ms2m", "content": "CRITICAL code injection in IBM Langflow OSS (1.0.0 \u2013 1.9.3): CVE-2026-10561 enables unauthenticated RCE. No patch yet \u2014 monitor IBM advisories. https://radar.offseq.com/threat/cve-2026-10561-cwe-94-improper-control-of-generati-066ce4d0e72e70d2 #OffSeq #Vuln #CVE202610561", "creation_timestamp": "2026-06-22T15:00:15.896902Z"}, {"uuid": "cca50acb-8698-40a5-b2a2-f6be81f07e0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10561", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3movakaqy3q2m", "content": "CVE-2026-10561 - Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection\nCVE ID : CVE-2026-10561\n \n Published : June 22, 2026, 1:22 p.m. | 2\u00a0hours, 21\u00a0minutes ago\n \n Description : IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerabilit...", "creation_timestamp": "2026-06-22T15:52:17.216940Z"}, {"uuid": "f32c1847-8130-43e3-8cde-503072df441a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10561", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3movcuf36ud2y", "content": "CVE-2026-10561 - Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection\nCVE ID : CVE-2026-10561\n \n Published : June 22, 2026, 1:22 p.m. | 1\u00a0hour, 48\u00a0minutes ago\n \n Description : IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability...", "creation_timestamp": "2026-06-22T16:33:44.652960Z"}, {"uuid": "a1517023-31ce-403e-b574-1e5e04669d36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10561", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3mow2ap6a2o2f", "content": "\ud83d\udea8  ALERT: CVE-2026-10561\n\nCVSS 10.0/10\n\n\ud83d\udccb WHAT IT IS:\nIBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in c", "creation_timestamp": "2026-06-22T23:32:13.878472Z"}, {"uuid": "3ee4e7cc-0e98-4049-82dd-2004695b4b0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10561", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3moxeqyvn5t22", "content": "CVE-2026-10561 - Critical auth bypass in IBM Langflow. Unauthenticated RCE via Python execution isolation flaw. CVSS 10.0. No patch available\u2014disconnect or mitigate immediately. #CVE #infosec #IBM\n\nhttps://www.valtersit.com/cve/CVE-2026-10561/", "creation_timestamp": "2026-06-23T12:12:58.444034Z"}, {"uuid": "0ef74fcd-2392-45d0-a7f2-987e1df0ba98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10562", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpjymnc2dq25", "content": "CVE-2026-10562 - Unauthenticated Open Redirect Vulnerability on TP-Link Archer AX20 Web Interface\nCVE ID : CVE-2026-10562\n \n Published : June 30, 2026, 8:34 p.m. | 1\u00a0hour, 11\u00a0minutes ago\n \n Description : An\nunauthenticated URL redirection vulnerability has been identified in A...", "creation_timestamp": "2026-06-30T21:56:21.785358Z"}, {"uuid": "791419de-7775-40dc-bcf6-21a745eb0397", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10560", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mppzjscc3y2o", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-10560 \u0432 IBM Langflow OSS: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/37352749-C6F8-48D7-92AC-CD3ED106AAC1", "creation_timestamp": "2026-07-03T07:28:38.690899Z"}, {"uuid": "dbbdfe74-6431-4a2b-b3e8-31409381306b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10560", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mr22hl22k62u", "content": "\ud83d\udccc CVE-2026-10560 - IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthentic... https://www.cyberhub.blog/cves/CVE-2026-10560", "creation_timestamp": "2026-07-20T00:37:07.414162Z"}, {"uuid": "00c2b2af-cf72-4f6b-b21d-8d4217d7a0c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10564", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mr245a72ph2y", "content": "\ud83d\udccc CVE-2026-10564 - IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in s... https://www.cyberhub.blog/cves/CVE-2026-10564", "creation_timestamp": "2026-07-20T01:07:25.243596Z"}, {"uuid": "8f89d9ae-f649-4d8f-a7af-ce05bb6b9f2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10561", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mr2v3ayquk2z", "content": "\u300cLangflow OSS\u300d\u306b\u8907\u6570\u306e\u6df1\u523b\u306a\u8106\u5f31\u6027 - \u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3067\u4fee\u6b63\n\nAI\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u958b\u767a\u57fa\u76e4\u300cLangflow OSS\u300d\u306b\u8907\u6570\u306e\u6df1\u523b\u306a\u8106\u5f31\u6027\u304c\u660e\u3089\u304b\u3068\u306a\u3063\u305f\u3002\n\nIBM\u304c\u73fe\u5730\u6642\u95936\u670821\u65e5\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea\u3092\u516c\u958b\u3057\u30012\u4ef6\u306e\u8106\u5f31\u6027\u300cCVE-2026-10561\u300d\u300cCVE-2026-7664\u300d\u306b\u3064\u3044\u3066\u660e\u3089\u304b\u306b\u3057\u305f\u3082\u306e\u3002\n\n\u300cCVE-2026-10561\u300d\u306f\u3001\u300cPython\u300d\u306e\u5b9f\u884c\u74b0\u5883\u306b\u304a\u3051\u308b\u5206\u96e2\u306e\u4e0d\u5099\u3084\u8a8d\u8a3c\u306e\u30d0\u30a4\u30d1\u30b9\u306b\u8d77\u56e0\u3059\u308b\u8106\u5f31\u6027\u3002\n\n\u9650\u5b9a\u3055\u308c\u305f\u30b0\u30ed\u30fc\u30d0\u30eb\u8f9e\u66f8\u3092\u69cb\u6210\u3059\u308b\u969b\u3001\u7d44\u307f\u8fbc\u307f\u95a2\u6570\u3092\u7121\u52b9\u5316\u3057\u3066\u3044\u306a\u3044\u305f\u3081\u3001\u8a31\u53ef\u30ea\u30b9\u30c8\u306b\u95a2\u4fc2\u306a\u304f\u95a2\u6570\u3092\u5229\u7528\u3067\u304d\u308b\u3002", "creation_timestamp": "2026-07-20T08:33:26.331426Z"}, {"uuid": "267fa469-84e2-4893-9ba2-f036158bb2e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105630", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5mvj3lya2n", "content": "\ud83d\udfe0 CVE-2026-105630 - High (8.7)\n\nPlane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege w...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105630/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T19:16:11.952857Z"}, {"uuid": "6198ab88-7c6a-4886-938b-72408a8894ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105631", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5mvqadat2y", "content": "\ud83d\udfe0 CVE-2026-105631 - High (7.5)\n\nPlane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105631/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T19:16:19.393526Z"}, {"uuid": "401272ce-b24d-4cf2-b885-09788cb0c5d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105628", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5mvymcjl2a", "content": "\ud83d\udfe0 CVE-2026-105628 - High (7.6)\n\nPlane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchroniza...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105628/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T19:16:28.339379Z"}, {"uuid": "13ee63f5-5fdd-4021-b8fe-1f493718e1bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105640", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mx5ow3633z2t", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-105640: Plane is an open-source project management tool\nCVSS 9.1\nhttps://beta.vulnsea.com/cve/CVE-2026-105640\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-10-05T19:52:17.195449Z"}, {"uuid": "05d5d35f-f04c-4b65-a280-9c120778605e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105638", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mx5ow4sr542l", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-105638: Plane is an open-source project management tool\nCVSS 9.1\nhttps://beta.vulnsea.com/cve/CVE-2026-105638\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-10-05T19:52:18.947019Z"}, {"uuid": "c77039c5-e811-4b2b-97c3-9a645f9c27ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105637", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mx5ow6hald2p", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-105637: Plane is an open-source project management tool\nCVSS 9.6\nhttps://beta.vulnsea.com/cve/CVE-2026-105637\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-10-05T19:52:20.569327Z"}, {"uuid": "88adccac-4ba7-4fa6-bc4b-23c3bf14ac88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105644", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/bposd33sy3n6u", "content": "CVE-2026-105644 - Ghost: Stored XSS via SVG Files in Content Imports\nCVE ID : CVE-2026-105644\n \n Published : Oct. 5, 2026, 6:53 p.m. | 17\u00a0minutes ago\n \n Description : Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports ...", "creation_timestamp": "2026-10-05T19:52:55.203512Z"}, {"uuid": "2e7c3ebd-2542-4e3e-8e8c-afe486847301", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105638", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5phucjvz2a", "content": "\ud83d\udd34 CVE-2026-105638 - Critical (9.1)\n\nPlane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login u...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105638/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T20:02:15.088332Z"}, {"uuid": "24ece73d-ef1a-4605-ae12-671d26220642", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105639", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5pi3j6s22r", "content": "\ud83d\udd34 CVE-2026-105639 - Critical (9.8)\n\nPlane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a lo...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105639/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T20:02:22.576102Z"}, {"uuid": "2189241d-242a-49fa-9055-73f57e46b571", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105640", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5pickjr62k", "content": "\ud83d\udd34 CVE-2026-105640 - Critical (9.1)\n\nPlane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses ret...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105640/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T20:02:30.272624Z"}, {"uuid": "59e53900-1f23-4f9f-a77f-a4c48dff5545", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105645", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/biafwopnrt7dv", "content": "CVE-2026-105645 - Ghost: Regular Expression Denial of Service in External Media Inliner\nCVE ID : CVE-2026-105645\n \n Published : Oct. 5, 2026, 6:56 p.m. | 14\u00a0minutes ago\n \n Description : Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request t...", "creation_timestamp": "2026-10-05T20:04:55.007641Z"}, {"uuid": "86dbea3c-4b46-4884-b5da-a6fd5944efa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105636", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx5pr7n5y32r", "content": "\ud83d\udea8 CVE-2026-105636 \u2014 CVSS 9.9 CRITICAL\n\nPlane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plan...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105636\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-05T20:07:27.905452Z"}, {"uuid": "47c901ee-e24a-497e-9233-bb4782c2269c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105637", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx5prhlp2v2l", "content": "\ud83d\udea8 CVE-2026-105637 \u2014 CVSS 9.6 CRITICAL\n\nPlane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105637\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-05T20:07:36.487714Z"}, {"uuid": "9b5da9df-a294-4b2e-b70e-19edaf32b817", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105638", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx5prpldfp2o", "content": "\ud83d\udea8 CVE-2026-105638 \u2014 CVSS 9.1 CRITICAL\n\nPlane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105638\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-05T20:07:44.364285Z"}, {"uuid": "41021dbb-31a9-432a-9a91-e961a8af2fb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105639", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx5pry7hka2z", "content": "\ud83d\udea8 CVE-2026-105639 \u2014 CVSS 9.8 CRITICAL\n\nPlane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in Us...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105639\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-05T20:07:53.422929Z"}, {"uuid": "1a12e4b4-c181-4d15-b839-b1f19b1727b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105640", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx5psa7cib2w", "content": "\ud83d\udea8 CVE-2026-105640 \u2014 CVSS 9.1 CRITICAL\n\nPlane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by G...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105640\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-05T20:08:01.905193Z"}, {"uuid": "fbf418c5-dab1-4cd1-94b4-a4db3ceaca00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105641", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx5psieq3w2l", "content": "\ud83d\udea8 CVE-2026-105641 \u2014 CVSS 9.8 CRITICAL\n\nPlane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deploym...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105641\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-05T20:08:10.384669Z"}, {"uuid": "1fad7c40-f43f-4bc2-a5ec-4298e0794401", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105646", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4m4dbz4t56mb7", "content": "CVE-2026-105646 - Ghost: Regular Expression Denial of Service in Content Import\nCVE ID : CVE-2026-105646\n \n Published : Oct. 5, 2026, 6:58 p.m. | 12\u00a0minutes ago\n \n Description : Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import fil...", "creation_timestamp": "2026-10-05T20:10:55.077296Z"}, {"uuid": "4823d09d-6a28-4899-a8ea-4f04626f39a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105641", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5qdb3h7s2r", "content": "\ud83d\udd34 CVE-2026-105641 - Critical (9.8)\n\nPlane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105641/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T20:17:35.051195Z"}, {"uuid": "ff5a022f-fb4b-4c88-b778-e9e78d7a4d8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105642", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5qdidnw72k", "content": "\ud83d\udfe0 CVE-2026-105642 - High (8.8)\n\nGhost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing libra...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105642/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T20:17:41.803422Z"}, {"uuid": "3fd0d9bb-4395-4372-8d8a-f718a4a95c84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105634", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5qdpcskl24", "content": "\ud83d\udfe0 CVE-2026-105634 - High (8.1)\n\nPlane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105634/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T20:17:49.551059Z"}, {"uuid": "704dd523-f405-44ba-bbb3-b40725e968cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105691", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5r6f4aqf2b", "content": "\ud83d\udd34 CVE-2026-105691 - Critical (9.9)\n\nPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter place...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105691/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T20:32:44.279149Z"}, {"uuid": "f917c253-6850-49cd-a900-5fa4485c8c4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105675", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5rclov4d2n", "content": "\ud83d\udfe0 CVE-2026-105675 - High (7.5)\n\nGhost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permissi...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105675/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T20:35:05.720012Z"}, {"uuid": "e2d85818-b398-4487-969b-5c5e911713c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105650", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5rcsmsm42y", "content": "\ud83d\udfe0 CVE-2026-105650 - High (8.1)\n\nGhost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an at...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105650/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T20:35:12.973342Z"}, {"uuid": "220d2994-a153-4f70-b31c-77811a7b7e36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105697", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5uhrf6ia2g", "content": "\ud83d\udd34 CVE-2026-105697 - Critical (9.9)\n\nLangflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105697/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T21:31:40.287242Z"}, {"uuid": "7a05afd3-61f5-4d16-8b79-e0e98f04a348", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105691", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx5widuqf327", "content": "\ud83d\udea8 CVE-2026-105691 \u2014 CVSS 9.9 CRITICAL\n\nPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attac...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105691\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-05T22:07:46.412119Z"}, {"uuid": "3978ea17-9132-4598-9397-d08f88bb4d7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105697", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx5wiluby62n", "content": "\ud83d\udea8 CVE-2026-105697 \u2014 CVSS 9.9 CRITICAL\n\nLangflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105697\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-05T22:07:54.652589Z"}, {"uuid": "797e8ba0-97a3-45e2-a4df-29aca149a660", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105636", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5ynybz2b2d", "content": "\ud83d\udd34 CVE-2026-105636 - Critical (9.9)\n\nPlane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in app...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105636/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T22:46:44.462694Z"}, {"uuid": "36f9733f-fac3-4156-8612-3bc1c909e800", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105637", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5yo7shej2h", "content": "\ud83d\udd34 CVE-2026-105637 - Critical (9.6)\n\nPlane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105637/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T22:46:51.998976Z"}, {"uuid": "dcc76ce7-fd93-44ae-a701-3ba7054c8079", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105611", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-105611", "content": "", "creation_timestamp": "2026-10-05T19:17:58.000000Z"}, {"uuid": "e4889abc-142f-4c83-8b4b-9bf31acf4247", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105621", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-105621", "content": "", "creation_timestamp": "2026-10-05T19:18:05.000000Z"}, {"uuid": "b9150fdf-508f-4425-a34a-bc5b50b743dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105699", "type": "seen", "source": "https://www.acn.gov.it/portale/w/langflow-disponibili-poc-per-lo-sfruttamento-di-4-vulnerabilita", "content": "", "creation_timestamp": "2026-10-06T02:28:15.000000Z"}, {"uuid": "febdfbde-4543-4ec2-8523-07b17b3979b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105697", "type": "seen", "source": "https://www.acn.gov.it/portale/w/langflow-disponibili-poc-per-lo-sfruttamento-di-4-vulnerabilita", "content": "", "creation_timestamp": "2026-10-06T02:28:15.000000Z"}, {"uuid": "1cb24c51-078c-4b10-bb7d-627c15814001", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10561", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mx7l5cizfq2n", "content": "CVE-2026-10561 - langflow\nIBM Langflow OSS versions 1.0.0 through 1.9.3 have a security weakness. An attacker without a login can potentially take control of your system. Update to the latest version to fix\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#langflow #pip #CVE #infosec", "creation_timestamp": "2026-10-06T13:50:05.221990Z"}, {"uuid": "c15cfc94-9a32-4de2-94e7-ecbff88f997a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-10561", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-8qpj-27x8-pwpq", "content": "", "creation_timestamp": "2026-10-06T13:38:28.000000Z"}, {"uuid": "793717d2-b4b0-4996-beda-cc6e640a3373", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105692", "type": "seen", "source": "https://t.me/hacking_Attack/196960", "content": "I wasn\u2019t running an intentional penetration test or actively hunting for bugs. I was simply using Penpot for standard work. As security\u2026Continue reading on Medium \u00bb (https://medium.com/@jsrini96/uncovering-cve-2026-105692-why-no-security-flaw-is-too-small-to-ignore-c50b9f5b6437?source=rss------bug_bounty-5)", "creation_timestamp": "2026-10-06T19:18:47.000000Z"}, {"uuid": "ea8e0a54-19be-4dbe-8431-86a4923114b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105692", "type": "seen", "source": "https://t.me/hacking_Attack/196958", "content": "Uncovering CVE-2026\u2013105692: Why No Security Flaw Is Too Small to Ignore\nhttps://medium.com/@jsrini96/uncovering-cve-2026-105692-why-no-security-flaw-is-too-small-to-ignore-c50b9f5b6437?source=rss------bug_bounty-5", "creation_timestamp": "2026-10-06T19:18:47.000000Z"}, {"uuid": "b3955501-2f50-487d-b98b-1981ab81339d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105692", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/196960", "content": "I wasn\u2019t running an intentional penetration test or actively hunting for bugs. I was simply using Penpot for standard work. As security\u2026Continue reading on Medium \u00bb (https://medium.com/@jsrini96/uncovering-cve-2026-105692-why-no-security-flaw-is-too-small-to-ignore-c50b9f5b6437?source=rss------bug_bounty-5)", "creation_timestamp": "2026-10-06T19:18:47.000000Z"}, {"uuid": "2f781046-4b46-451e-adeb-778df6ad9c09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105697", "type": "seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mxbewhy3cn27", "content": "Vuln\u00e9rabilit\u00e9s critiques (CVSS \u2265 9) \u00b7 6\n\u2022 Langflow (CVE-2026-105697), CVSS 9.9 (Langflow)\n\u2022 Apache Struts (legacy REST Action Mappers) (CVE-2026-104711), CVSS 9.8 (Apache)\n\u2022 Dell System Update (Serveurs Dell PowerEdge) (CVE-2026-86360), CVSS 9.6 (it-connect.fr)", "creation_timestamp": "2026-10-07T07:04:12.052769Z"}, {"uuid": "ac56064d-8eae-4aac-9b55-d601011db4d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105636", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxcekdcbqz2w", "content": "CVE-2026-105636 - plane\nThe Plane project\u2011management app lets users set up webhooks. Because the system follows redirects without checking the final address, a malicious webhook can be made to pull\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#plane #makeplane #CVE #infosec", "creation_timestamp": "2026-10-07T16:30:04.391794Z"}, {"uuid": "709348ef-9970-44a7-b159-98b8733b6e7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105637", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxcekelvpl2n", "content": "CVE-2026-105637 - plane\nIn versions of Plane before 1.4.0, a user with Guest access could supply identifiers of files that belong to a different project in the same workspace and trick the system into\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#plane #makeplane #CVE #infosec", "creation_timestamp": "2026-10-07T16:30:05.468948Z"}, {"uuid": "477b7191-5765-4b43-b182-1f28f16719b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105638", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxcf4assii2q", "content": "CVE-2026-105638 - plane\nThe Plane project\u2011management tool lets anyone try unlimited six\u2011digit email login codes because it does not limit how often a code can be entered. This means an attacker could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#plane #makeplane #CVE #infosec", "creation_timestamp": "2026-10-07T16:40:05.697040Z"}, {"uuid": "04bb7819-064f-4113-9ace-8f859bbd4df6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105639", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxcf4c4d542w", "content": "CVE-2026-105639 - plane\nThe open\u2011source project management tool Plane (versions before 1.4.0) creates a user record for any email address without confirming ownership. Because the invitation details,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#plane #makeplane #CVE #infosec", "creation_timestamp": "2026-10-07T16:40:07.073709Z"}, {"uuid": "b0430a92-593c-4aee-ac44-4030c7fa8b5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105640", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxcfo3d4pb2x", "content": "CVE-2026-105640 - plane\nThe Plane project\u2011management app (versions before 1.4.0) accepts email addresses from Gitea or self\u2011hosted GitLab OAuth logins without checking if the provider has verified them. An\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#plane #makeplane #CVE #infosec", "creation_timestamp": "2026-10-07T16:50:04.384588Z"}, {"uuid": "ae48718a-073e-4cb4-ba91-a784024d4fde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105641", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxcfo4onbr2x", "content": "CVE-2026-105641 - plane\nThe open\u2011source Plane tool (versions before 1.4.0) includes deployment files that contain fixed secret keys. If these defaults are not changed, anyone who knows the keys can create\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#plane #makeplane #CVE #infosec", "creation_timestamp": "2026-10-07T16:50:05.155479Z"}, {"uuid": "b60f071d-2518-42f0-918a-c791f054c80c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105691", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxchdwwt3b2l", "content": "CVE-2026-105691\nIf a user can edit a design in Penpot, they can insert special text into a color setting that causes the system to run unintended commands when the file is exported as SVG. This can be triggered even through a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-10-07T17:20:11.269075Z"}, {"uuid": "3f831464-e6c5-4be4-93e9-31f7643c2563", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105697", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxchebm5kb2r", "content": "CVE-2026-105697 - langflow\nIf an attacker can change the MCP server settings in Langflow, they can make the software execute any operating\u2011system command, such as deleting files or opening a backdoor.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#langflow #langflowai #CVE #infosec", "creation_timestamp": "2026-10-07T17:20:24.144683Z"}, {"uuid": "d08ffb63-bba3-4926-a27a-933ef65e0a79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105697", "type": "published-proof-of-concept", "source": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45", "content": "", "creation_timestamp": "2026-09-28T17:26:49.000000Z"}, {"uuid": "713ac6f0-c141-49e0-9318-9f1bed5c40e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105698", "type": "published-proof-of-concept", "source": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-gh98-4phw-6fmw", "content": "", "creation_timestamp": "2026-09-28T17:13:05.000000Z"}, {"uuid": "f5459ec2-dde4-419d-a072-00030336bb12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105642", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mxcvg7rtoy2q", "content": "Ghost 6.56.0-6.65.0 lets any staff user run commands through a bookmark card image. CVE-2026-105642 is fixed in Ghost 6.67.0; Contributors are included in the affected scope. #software", "creation_timestamp": "2026-10-07T21:32:01.220823Z"}, {"uuid": "169a456e-d6b5-49d7-990e-0301b15d9200", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105699", "type": "published-proof-of-concept", "source": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-4hmc-cfm3-w43c", "content": "", "creation_timestamp": "2026-09-22T17:52:45.000000Z"}, {"uuid": "ba147bc9-3a20-4408-aa6b-5efea2842fe8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105686", "type": "published-proof-of-concept", "source": "https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8", "content": "", "creation_timestamp": "2026-09-25T18:53:40.000000Z"}, {"uuid": "78cb59ad-ea7f-40ae-96d9-8ac390da9de7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105697", "type": "seen", "source": "https://gist.github.com/alon710/6614304235c0dc126039860ab423b97a", "content": "# CVE-2026-105697: CVE-2026-105697: OS Command Injection in Langflow Model Context Protocol Integration\n\n> **CVSS Score:** 9.9\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105697\n\n## Summary\nA critical OS command injection vulnerability exists in Langflow's Model Context Protocol (MCP) server integration using stdio transport, allowing unauthenticated remote command execution under default configurations.\n\n## TL;DR\nLangflow versions prior to 1.10.3 allowed unauthenticated remote attackers to execute arbitrary shell commands on the hosting system by exploiting a model context protocol (MCP) server integration wrapper that parsed commands inside a shell context.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78 (Improper Neutralization of Special Elements used in an OS Command)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Severity Score**: 9.9 (Critical)\n- **EPSS Score**: 0.00396\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- langflow\n- langflow-base\n- lfx\n- **langflow**: >= 1.1.2, < 1.10.3 (Fixed in: `1.10.3`)\n- **langflow-base**: >= 0.1.2, < 0.10.3 (Fixed in: `0.10.3`)\n- **lfx**: < 1.10.3 (Fixed in: `1.10.3`)\n\n## Mitigation\n\n- Upgrade Langflow, langflow-base, and lfx to secure versions (>= 1.10.3 / >= 0.10.3)\n- Disable the development auto-login feature in production environments\n- Apply strict network firewall policies to restrict public access to port 7860\n\n**Remediation Steps:**\n1. Step 1: Terminate current insecure Langflow container or system processes.\n2. Step 2: Update the requirement files or container images to target version 1.10.3.\n3. Step 3: Modify configuration settings, ensuring the environment variable LANGFLOW_AUTO_LOGIN is explicitly configured to false.\n4. Step 4: Restart the service and verify that the endpoint /api/v1/auto_login no longer issues authorization tokens without authentication.\n\n## References\n\n- [GitHub Security Advisory GHSA-w794-rj3p-xv45](https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45)\n- [NVD Record for CVE-2026-105697](https://nvd.nist.gov/vuln/detail/CVE-2026-105697)\n- [Authoritative CVE Project Entry](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105697.json)\n- [Langflow Release v1.10.3](https://github.com/langflow-ai/langflow/releases/tag/v1.10.3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105697) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T11:30:28.000000Z"}, {"uuid": "7050ff8e-7f67-4014-a5d0-46ff2bb95bb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105698", "type": "seen", "source": "https://gist.github.com/alon710/f2524db396d7ed518818052701b0f388", "content": "# CVE-2026-105698: CVE-2026-105698: Missing Authorization in Deprecated Chat Vertices Endpoints in Langflow\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105698\n\n## Summary\nA missing authorization vulnerability in Langflow versions 1.0.0 through 1.10.0 allows authenticated users (and unauthenticated users in versions prior to 1.7.2) to access private workflow structures and execute graph components by targeting deprecated API endpoints.\n\n## TL;DR\nUnauthenticated or low-privilege users can execute private flow vertices and read workflow configurations in Langflow versions prior to 1.10.1.\n\n## Technical Details\n\n- **CWE ID**: CWE-862, CWE-639\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.4 (Medium)\n- **EPSS Score**: 0.00177\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Langflow\n- langflow-base\n- **langflow**: >= 1.0.0, < 1.10.1 (Fixed in: `1.10.1`)\n- **langflow-base**: < 0.10.1 (Fixed in: `0.10.1`)\n\n## Mitigation\n\n- Upgrade Langflow to version 1.10.1 or higher.\n- Upgrade langflow-base to version 0.10.1 or higher.\n- Implement reverse proxy rules to drop requests to deprecated vertices endpoints.\n- Configure WAF signatures to detect and block access to endpoints matching the deprecated route paths.\n\n**Remediation Steps:**\n1. Identify all deployment instances of Langflow and verify current running versions.\n2. Execute pip update command: pip install --upgrade langflow langflow-base\n3. Verify the application version reports 1.10.1 (Langflow) and 0.10.1 (langflow-base) or newer.\n4. Deploy custom Nginx ingress or WAF configurations if patching windows are delayed.\n\n## References\n\n- [GitHub Security Advisory GHSA-gh98-4phw-6fmw](https://github.com/langflow-ai/langflow/security/advisories/GHSA-gh98-4phw-6fmw)\n- [Fix Commit](https://github.com/langflow-ai/langflow/commit/fb3d6ec90b1e4d52eaa40915a64b1f86b6542f55)\n- [OSS Authorization PR #13153](https://github.com/langflow-ai/langflow/pull/13153)\n- [Official Release 1.10.1](https://github.com/langflow-ai/langflow/releases/tag/v1.10.1)\n- [National Vulnerability Database (NVD) Page](https://nvd.nist.gov/vuln/detail/CVE-2026-105698)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-105698)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105698) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T12:30:31.000000Z"}, {"uuid": "ce9f7edc-d7c9-4805-8cb9-b0f44d50953c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105647", "type": "seen", "source": "https://gist.github.com/alon710/e9c5321f79c46f7c54f00ee758f049f3", "content": "# CVE-2026-105647: CVE-2026-105647: Server-Side Request Forgery via Favicon Probing in Ghost CMS\n\n> **CVSS Score:** 4.0\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105647\n\n## Summary\nAn unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Ghost CMS from version 6.54.1 to 6.65.0. The vulnerability stems from a validation bypass in the favicon resolution logic within the bookmark-fetching subsystem, which allows remote, unauthenticated attackers to trigger arbitrary HTTP requests to the local host and internal networks. This bypass circumvents the custom DNS-level IP blocklist controls configured globally in the application.\n\n## TL;DR\nGhost CMS versions 6.54.1 through 6.64.0 are vulnerable to unauthenticated blind SSRF due to a validation bypass in the favicon resolution flow. Attackers can leverage this to make HTTP requests targeting private and loopback networks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918 / CWE-367\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.0 (Medium)\n- **Exploit Status**: PoC / Analytical\n- **CISA KEV Status**: Not Listed\n- **Impact**: Low Confidentiality (Blind SSRF)\n\n## Affected Systems\n\n- Ghost Content Management System (CMS)\n- **Ghost**: >= 6.54.1, < 6.65.0 (Fixed in: `6.65.0`)\n\n## Mitigation\n\n- Upgrade Ghost to version 6.65.0 or later to apply the official security patch.\n- Enforce outbound firewall boundaries at the operating system or cloud configuration layer.\n- Proxy outbound application traffic through a dedicated forward proxy with restricted destination ACLs.\n\n**Remediation Steps:**\n1. Step 1: Inspect the running Ghost application version via the admin panel or package manifest.\n2. Step 2: Execute command 'npm install ghost@6.65.0' or use the CLI updater 'ghost update' to upgrade the instance.\n3. Step 3: Establish local host egress rules limiting outbound TCP requests to valid public subnets.\n\n## References\n\n- [GitHub Security Advisory GHSA-322m-ff4g-9vx9](https://github.com/TryGhost/Ghost/security/advisories/GHSA-322m-ff4g-9vx9)\n- [NVD - CVE-2026-105647 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-105647)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105647) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T16:30:28.000000Z"}, {"uuid": "551440f8-313a-46f9-89e7-33db4b924563", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-105698", "type": "seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3mxjzczltr22f", "content": "Critical auth flaw in Langflow lets unauthenticated users access private workflows and execute components. Upgrade to 1.10.1 or\u2026\n\nhttps://dev.to/cverports/cve-2026-105698-cve-2026-105698-missing-authorization-in-deprecated-chat-vertices-endpoints-in-24n0\n\n#appsec #DevSecOps", "creation_timestamp": "2026-10-10T17:30:25.965392Z"}]}