CVE Notifier

CVE-2026-84632 CWE-? N/A

CVE-2026-84632

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. …

cve.org Apple:iOS · and · iPadOS 14 Sep 2026

CVE-2026-84560 CWE-? N/A

CVE-2026-84560

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may gain unauthorized access to Bluetooth.

cve.org Apple:iOS · and · iPadOS 14 Sep 2026

CVE-2026-84537 CWE-? N/A

CVE-2026-84537

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination or corrupt kernel memory…

cve.org Apple:macOS 14 Sep 2026

CVE-2026-84521 CWE-? N/A

CVE-2026-84521

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An app…

cve.org Apple:iOS · and · iPadOS 14 Sep 2026

CVE-2026-84576 CWE-? N/A

CVE-2026-84576

This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.

cve.org Apple:macOS 14 Sep 2026

CVE-2026-90820 CWE-862 4.3

a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization

A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/se…

cve.org a2aproject:a2a-java 14 Sep 2026

CVE-2026-81901 CWE-862 N/A

Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights o…

cve.org Concrete · CMS:Concrete · CMS 14 Sep 2026

CVE-2026-81902 CWE-352 N/A

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup

Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote attacker could craft a request that, when loaded by an authenticated user holding edi…

cve.org Concrete · CMS:Concrete · CMS 14 Sep 2026

CVE-2026-12763 CWE-306 4.2

Langflow is vulnerable to authentication bypass and insufficient session expiration

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

cve.org IBM:Langflow · OSS 14 Sep 2026

CVE-2026-12765 CWE-918 6.5

Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumerat…

cve.org IBM:Langflow · OSS 14 Sep 2026

CVE-2026-90819 CWE-113 7.3

a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/Ba…

cve.org a2aproject:a2a-java 14 Sep 2026

CVE-2026-12766 CWE-918 5.4

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeratio…

cve.org IBM:Langflow · OSS 14 Sep 2026