Recent Advisories

Severity ID Title Vendor Product Date Type
MEDIUM 5.7 CVE-2026-56117

dhcpcd Heap Use-After-Free via Control Socket Handling_CVE-2026-56117

dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c th...

NetworkConfiguration dhcpcd CVE
MEDIUM 6 CVE-2026-56115

dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()_CVE-2026-56115

dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c t...

NetworkConfiguration dhcpcd CVE
MEDIUM 6 CVE-2026-56114

dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()_CVE-2026-56114

dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c t...

NetworkConfiguration dhcpcd CVE
MEDIUM 6 CVE-2026-56113

dhcpcd Heap Use-After-Free in dhcp6_deprecateaddrs via DHCPv6 RENEW_CVE-2026-56113

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to cra...

NetworkConfiguration dhcpcd CVE
MEDIUM 6.1 CVE-2026-55423

Langflow: Logout button does not clear session_CVE-2026-55423

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The pr...

langflow-ai langflow < 1.7.0 CVE
MEDIUM 6.3 CVE-2026-54308

n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node_CVE-2026-54308

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validat...

n8n-io n8n >= 2.26.0, < 2.26.2 CVE
MEDIUM 6.3 CVE-2026-54306

n8n: Prototype Pollution enables confused-deputy execution via public webhooks_CVE-2026-54306

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public webhoo...

n8n-io n8n >= 2.26.0, < 2.26.2 CVE
MEDIUM 6.1 CVE-2026-50019

yt-dlp: File Downloader cookie leak with curl_CVE-2026-50019

yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies ma...

yt-dlp yt-dlp >= 2023.09.24, < 2026.06.09 CVE
MEDIUM 6 CVE-2026-49465

n8n: Git Node Clone and Push Operations Bypass File Sandbox_CVE-2026-49465

n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modif...

n8n-io n8n < 1.123.48 CVE
MEDIUM 6.1 CVE-2026-48520

Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read_CVE-2026-48520

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the "Shareable Playground" (or "Public Flows" in co...

langflow-ai langflow < 1.10.0 CVE