CVE Notifier

CVE-2026-12767 CWE-918 6.5

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumerat…

cve.org IBM:Langflow · OSS 14 Sep 2026

CVE-2026-13107 CWE-611 7.1

Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default.

cve.org IBM:Business · Automation · Workflow 14 Sep 2026

CVE-2026-53714 CWE-306 7.4

Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, configured through provider…

cve.org envoyproxy:gateway 14 Sep 2026

CVE-2026-13260 CWE-770 N/A

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.

cve.org IBM:Verify · Identity · Access 14 Sep 2026

CVE-2026-53716 CWE-789 6.5

Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip…

cve.org envoyproxy:gateway 14 Sep 2026

CVE-2026-90818 CWE-918 4.3

netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery

A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the…

cve.org netease-youdao:LobsterAI 14 Sep 2026

CVE-2026-53715 CWE-362 5.3

Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer.ServeHTTP in internal/wasm/httpserver.go reads the plain mapp…

cve.org envoyproxy:gateway 14 Sep 2026

CVE-2026-81903 CWE-79 N/A

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into …

cve.org Concrete · CMS:Concrete · CMS 14 Sep 2026

CVE-2026-53719 CWE-476 6.5

Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, translateSecurityPolicyForRoute in internal/gatewayapi/securitypolicy.go…

cve.org envoyproxy:gateway 14 Sep 2026

CVE-2026-13272 CWE-1385 N/A

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems.

cve.org IBM:Verify · Identity · Access 14 Sep 2026

CVE-2026-13276 CWE-79 N/A

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001 and IBM Verify Identity Access Container 11.0.0 through 11.0.3 Interim Fix 001 and I…

cve.org IBM:Verify · Identity · Access 14 Sep 2026

CVE-2026-53718 CWE-862 6.4

Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference…

cve.org envoyproxy:gateway 14 Sep 2026