New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Langflow OSS: Code execution via stored Python components in public workflows

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a code injection flaw (CWE-94). A remote attacker can trigger Python component code already stored in a public workflow. The code then runs under the flow owner's runtime context inside the Langflow server process, bypassing the rule that public execution paths may only run server-trusted components. The CVE data provided lists CVSS 9.8, while IBM's bulletin rates the issue 6.5 with a different vector, and the authentication requirement is not confirmed, so check the final score in NVD.

IBM · Langflow OSS

Frappe Framework: Path traversal in file upload leads to remote code execution

Frappe Framework versions before 15.121.0 and 16.x before 16.34.0 do not validate the destination path during certain file uploads. An authenticated user can write files outside the intended storage directory, which can lead to remote code execution on the server with a CVSS 4.0 score of 9.4 (Critical). The vendor and CNA rate it as critical, while VulDB lists a much lower base score of 6.3. Internet-facing instances or instances with many user accounts, including self-registration, carry the highest risk.

Frappe · Frappe Framework

Frappe Framework: Server-side template injection via message fields

Frappe Framework versions before 15.111.0 and 16.x before 16.21.0 render user-controlled message fields as templates without neutralization. An authenticated user with a common operational role can inject template expressions that the server evaluates in an unrestricted context. Successful exploitation can lead to code execution on the server, with high impact on confidentiality, integrity and availability, though the exact impact is not confirmed by the vendor.

Frappe · Frappe Framework

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

ZITADEL Login V2: Missing authorization when approving device authorizations

ZITADEL Login V2 approves OAuth 2.0 device authorizations with the browser's existing signed-in session, without asking for consent or requiring the user code shown on the device. An attacker who starts a device authorization and gets a signed-in user to open one link can receive that user's tokens, including API access with the ZITADEL project scope. The same missing check allows bypassing project access settings through the OIDC device authorization API.

ZITADEL · ZITADEL

ZITADEL: Account takeover in Login V2 via forgeable verificationCheck cookie

ZITADEL's hosted Login V2 UI trusts a verificationCheck cookie that is derived only from the user ID and the browser fingerprint, so it can be computed by anyone. An unauthenticated attacker who knows the user ID or login name of an active user without any authentication method can set that user's first password, register a passkey, or link an external identity provider, and then sign in as that user. Users who already have a password, passkey or identity provider link are not affected, and the ZITADEL APIs are not affected.

ZITADEL · ZITADEL

ZITADEL: Host header injection in Login V2 enables account takeover

ZITADEL versions 4.0.0 up to 4.19.4 accept untrusted public host headers in the Login V2 UI. An unauthenticated attacker who knows a victim's login name can make genuine password-reset, invite and email-verification emails contain links to the attacker's host. When the victim opens the link, or automated mail scanning fetches it, the attacker captures the single-use code and can take over the account, including instance administrators. User interaction is required, and the default Login V2 deployment is affected.

ZITADEL · ZITADEL