Analysis

IBM reports a critical flaw in Langflow OSS 1.0.0 through 1.10.0 voice mode, where API clients are reused across tenant boundaries. An authenticated attacker can manipulate cache state so that other users' requests are processed with incorrect upstream API credentials, causing billing and accountability misattribution. The record lists no fixed version and no confirmed exploitation.

A flaw in the GDBus introspection parser of GLib, reached through g_dbus_node_info_new_for_xml(), can be triggered by malformed XML that nests a node element inside method, signal, property or arg elements. According to the record, this leads to an unsigned integer overflow and an out-of-bounds read, causing denial of service. No confirmed exploitation appears in the sources consulted.

CVE-2026-48277 is an Improper Input Validation weakness (CWE-20) in Adobe ColdFusion, described as allowing arbitrary code execution in the context of the current user without user interaction. The CNA rates it critical with a CVSS 3.1 base score of 10. The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted.

Apache Tomcat is affected by a CWE-390 weakness (Detection of Error Condition Without Action) in the configuration of certificate revocation lists (CRLs) for an FFM-based connector. The record assigns a CVSS 3.1 base score of 9.1 (critical) and lists affected ranges in three release branches, with fixed versions 11.0.23, 10.1.56 and 9.0.119. No confirmed exploitation appears in the sources consulted.

Raytha CMS contains an SQL injection flaw (CWE-89) in its OData filter parsing pipeline, which according to CERT Polska can be reached remotely without authentication. The CNA assigns a CVSS 4.0 base score of 9.3 and reports confirmation in version 1.5.2, with other versions possibly affected. No vendor fix appears in the sources consulted, and the CVE is not listed in CISA KEV.

CVE-2026-58053 affects Gitea act_runner when it uses the Docker backend. According to the record, options in a workflow's container.options string, such as host PID namespace and added capabilities, can still be applied when privileged is set to false, which may let a user who can run workflows reach root on the host. The CNA reports a critical CVSS 3.1 score, the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

CVE-2026-53309 is an off-by-one error in the ocfs2/DLM code of the Linux kernel, in the dlm_match_regions() function, where a loop comparing local and remote regions reads one entry past the valid range. The CNA scored it 9.8 (critical) under CVSS 3.1, but the record does not describe the consequences of the out-of-bounds read, and no confirmed exploitation appears in the sources consulted.

CVE-2026-52782 affects OpenProject versions prior to 17.3.3 and 17.4.1. According to the record, a project administrator can reassign the managed folder of another project on the same Nextcloud or OneDrive storage, so the next sync applies the attacker project's user list to that folder. The CNA rated it critical with CVSS 3.1 score 9.9, and it is not listed in CISA KEV.

OpenBMB ChatDev through 2.2.0 contains a path traversal flaw (CWE-22) in its upload handling, where the destination path is built from the multipart filename without sanitization. The record states that unauthenticated remote actors can write or delete arbitrary files on the server, and that the issue is fixed in commit 4fd4da6. No confirmed exploitation in the wild appears in the sources consulted.

An anonymous caller can bypass the Kestra REST API authentication filter by using a path ending in configs, which allows unauthenticated creation and execution of flows with Shell or Process tasks. The record rates it critical with CVSS 3.1 score 10.0 and states it is fixed in 1.0.45 and 1.3.21. No confirmed active exploitation appears in the sources consulted.

CVE-2026-12415 affects the Invoice Generator plugin for WordPress in versions up to and including 1.0.0. A missing capability check in an AJAX action allows unauthenticated users to change the email address of any account, including administrators. The CNA Wordfence rates it Critical with a CVSS 3.1 base score of 9.8, and no confirmed exploitation appears in the sources consulted.

CVE-2026-8402 is a critical SQL injection flaw (CWE-89) in Eksagate SYSGUARD 6001 that allows blind SQL injection, per the record. The CNA USOM assigned a CVSS 3.1 base score of 9.8. The vendor reportedly stated the product is not supported, so a fixed release may not be available.

CVE-2026-53690 is an SQL injection flaw in Redeight CMS version 1.0. The userEmail field in the POST login request to /admin/index.php is concatenated into SQL queries without sanitization or prepared statements. The CNA cvd@cert.pl rates it 9.3 under CVSS 4.0, and the record reports no confirmed exploitation.

CVE-2026-56068 is an unauthenticated SQL injection (CWE-89) in the JetEngine plugin for WordPress, affecting versions up to and including 3.8.10.2. The CNA Patchstack assigned a CVSS 3.1 base score of 9.3 (Critical), but the sources consulted do not list a fixed version. No confirmed exploitation appears in the sources consulted.

CVE-2026-10109 affects IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4. The flaw is a remote code execution issue caused by improper handling of the DRDA handshake before authentication, rated critical with a CVSS 3.1 base score of 9.8. The record lists no fixed versions, so administrators should consult the IBM advisory and prioritize inventory and exposure reduction.