CVE Vulnerabilities - 15 October 2026

Langflow Smart Transform can run attacker code

CVE-2026-7700 GHSA-9fpm-3445-2vx4 PYSEC-2026-4232

Versions of Langflow from 1.3.0 to 1.10.2 let a specially crafted prompt create and run arbitrary Python code. An attacker who can control the instructions or input passed to the Smart Transform compo...

2.1

pfSense CE lets VPN users run system commands

CVE-2026-111225

Versions 2.5.0 through 2.9.0 of Netgate pfSense CE let an authenticated VPN client add specially crafted data to their certificate name or username, which the system then runs as a low‑privilege user....

2.3

pfSense CE allows malicious link to run scripts in WebGUI

CVE-2026-111233

Versions 2.7.1 through 2.9.0 of pfSense CE’s firewall rule page can be tricked into running code that an attacker supplies in a web link. If the optional “Require Firewall Interface” setting is turned...

2.3

Strawberry GraphQL-WS may block new subscriptions

CVE-2026-107727 GHSA-m952-2w3f-6r8h PYSEC-2026-4302

If you use Strawberry's older GraphQL‑WS protocol with a limit on how many subscriptions can run on one WebSocket connection, the system can incorrectly count completed subscriptions as still active. ...

3.7

docling sends configured headers to any remote image host

CVE-2026-105742 GHSA-p3fw-7699-7926 PYSEC-2026-4189 PYSEC-2026-4212

When docling is set to fetch images from remote URLs and custom headers are supplied, it includes those headers on every image request, even to sites the document references. This can expose API keys,...

3.7

langfuse may allow unauthorized actions through gRPC JavaScript

CLEANSTART-2026-AF37624

The langfuse package uses the @grpc/grpc-js library, which runs gRPC entirely in JavaScript. This can be exploited to perform actions you did not intend, potentially exposing data or system behavior. ...

3.7

Elasticsearch, Strimzi Kafka Operator, Kafka risk malicious LZ4 data

CLEANSTART-2026-YW37682

The Java LZ4 compression library used by Elasticsearch, Strimzi Kafka Operator and Kafka can be fooled by specially crafted compressed files. This could let an attacker cause the application to crash ...

3.7

Elasticsearch may use wrong DNS settings causing misdirected queries

CLEANSTART-2026-UA66852

When several Elasticsearch clients use different DNS configurations, the underlying network library can mistakenly reuse an old DNS resolver. This can lead to queries being sent to the wrong server, p...

3.7

cleanstart py3-pydantic-ai could let attackers run code

CLEANSTART-2026-BF25173

The py3-pydantic-ai package used for building AI workflows contains a flaw that may allow an attacker to execute arbitrary code on the system running it. This could affect any application that relies ...

3.7

Renovate may mix response data on retry

CLEANSTART-2026-ZP07254

Renovate's retry feature can combine parts of a server's reply with data from a later retry, causing the final response to contain extra or corrupted information while still showing the original statu...

3.7

BusyBox httpd can reveal valid usernames

CVE-2026-88834 DEBIAN-CVE-2026-88834 UBUNTU-CVE-2026-88834

BusyBox’s built‑in web server can leak whether a username exists when it is set up to use system passwords and compiled with uncommon options. This issue only affects certain custom builds of BusyBox ...

3.7

Godot Engine may crash or expose memory via crafted translation

CVE-2026-110736 UBUNTU-CVE-2026-110736

The Godot Engine up to version 4.7.2 can read data from a translation file that it thinks is safe, but a specially crafted file can cause it to read from the wrong place in memory. This can make the p...

3.6

Helium planner lets uploaded SVG run scripts

CVE-2026-55876 GHSA-7r65-76fw-ch5c

In Helium versions before 2.2.60, signed‑in users could upload SVG or HTML files that were not blocked. When someone opens the public link to that file, the embedded script runs, which could be used f...

3.5

EspoCRM lets attackers hijack sessions via templates

CVE-2026-55184 GHSA-x5p5-8mxj-9wv6

EspoCRM versions before 9.3.9 allow a user with template‑editing rights to save malicious HTML in email or PDF templates. When another user opens that template while content‑security‑policy protection...

3.5

CGA-pr3g-gjg4-6gg9

CGA-pr3g-gjg4-6gg9

3.3

CGA-mc5h-784q-p4rq

CGA-mc5h-784q-p4rq

3.3

CGA-whf3-5w2m-89hv

CGA-whf3-5w2m-89hv

3.3

CGA-j7fv-4gvj-cw54

CGA-j7fv-4gvj-cw54

3.3

CGA-6w6v-gj9x-987w

CGA-6w6v-gj9x-987w

3.3

CGA-p5g4-7h47-rch8

CGA-p5g4-7h47-rch8

3.3

CGA-4vr7-qxjj-vh9f

CGA-4vr7-qxjj-vh9f

3.3

CGA-8hfh-2h69-6w7w

CGA-8hfh-2h69-6w7w

3.3

CGA-65mg-6p9r-grh3

CGA-65mg-6p9r-grh3

3.3

CGA-f4xv-c6mq-3678

CGA-f4xv-c6mq-3678

3.3

CGA-62p8-f5hv-f9gw

CGA-62p8-f5hv-f9gw

3.3