🚨 CVE-2026-50335
Improper access control in Windows Operating Systems allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Improper access control in Windows Operating Systems allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50360
Incorrect implementation of authentication algorithm in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Incorrect implementation of authentication algorithm in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-50365
Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network.
🎖@cveNotify
Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network.
🎖@cveNotify
🚨 CVE-2026-50371
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows LUAFV allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows LUAFV allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50406
Use after free in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50421
Access of resource using incompatible type ('type confusion') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Access of resource using incompatible type ('type confusion') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50425
Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50427
Use after free in Content Delivery Manager allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Content Delivery Manager allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50435
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50440
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50491
Out-of-bounds read in Code Integrity DLL (ci.dll) allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Out-of-bounds read in Code Integrity DLL (ci.dll) allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50666
Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-50686
Access of resource using incompatible type ('type confusion') in Windows OLE allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Access of resource using incompatible type ('type confusion') in Windows OLE allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-56183
Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-56187
Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-56647
Integer overflow or wraparound in Windows Remote Access Service Infrastructure allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Integer overflow or wraparound in Windows Remote Access Service Infrastructure allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-57088
Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-57089
Use after free in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Use after free in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-58537
Use after free in Microsoft NAT Helper Components (ipnathlp.dll) allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Microsoft NAT Helper Components (ipnathlp.dll) allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-9103
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTO_LOGIN configuration is enabled (enabled by default), which may allow an unauthenticated network attacker to obtain full administrative access. Additionally, permissive cross-origin resource sharing (CORS) settings may allow tokens to be exposed to unintended origins, increasing the risk of unauthorized access.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTO_LOGIN configuration is enabled (enabled by default), which may allow an unauthenticated network attacker to obtain full administrative access. Additionally, permissive cross-origin resource sharing (CORS) settings may allow tokens to be exposed to unintended origins, increasing the risk of unauthorized access.
🎖@cveNotify
Ibm
Security Bulletin: Unauthenticated Superuser Token Issuance via Auto-Login Endpoint
An unauthenticated endpoint in the login API allowed any network-reachable attacker to obtain a 365-day superuser bearer token without requiring any credentials. The /api/v1/login/auto_login endpoint issued tokens when the AUTO_LOGIN configuration defaulted…
🚨 CVE-2026-9135
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control. The vulnerability exists because the validation mechanism only checks the main component source code in node_template["code"]["value"] but fails to validate dynamic CodeInput fields that store generated ToolGuard Python files. Attackers can embed malicious Python code in these unvalidated dynamic fields, which are persisted in Flow.data and later executed server-side when a guarded tool is invoked through the ToolGuard runtime. This allows authenticated users with flow creation privileges to achieve arbitrary Python code execution on the backend despite custom component restrictions. The vulnerability can be escalated through cross-tenant flow manipulation via the agentic MCP update_flow_component_field tool, which accepts attacker-controlled user_id parameters, enabling attackers to inject malicious code into victim users' flows. When combined with publicly accessible flows and specific misconfigurations (AUTO_LOGIN=true, NEW_USER_IS_ACTIVE=true), the attack can be conducted with reduced authentication requirements.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control. The vulnerability exists because the validation mechanism only checks the main component source code in node_template["code"]["value"] but fails to validate dynamic CodeInput fields that store generated ToolGuard Python files. Attackers can embed malicious Python code in these unvalidated dynamic fields, which are persisted in Flow.data and later executed server-side when a guarded tool is invoked through the ToolGuard runtime. This allows authenticated users with flow creation privileges to achieve arbitrary Python code execution on the backend despite custom component restrictions. The vulnerability can be escalated through cross-tenant flow manipulation via the agentic MCP update_flow_component_field tool, which accepts attacker-controlled user_id parameters, enabling attackers to inject malicious code into victim users' flows. When combined with publicly accessible flows and specific misconfigurations (AUTO_LOGIN=true, NEW_USER_IS_ACTIVE=true), the attack can be conducted with reduced authentication requirements.
🎖@cveNotify
Ibm
Security Bulletin: Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation
A validation bypass existed in the flow component code verification mechanism. The custom component policy enforcement validated only the main component code field but did not extend validation to dynamic CodeInput fields used by the Policies component. An…