IBM has disclosed seven vulnerabilities in Langflow OSS, including critical flaws such as authentication bypass and code injection that attackers can exploit remotely without credentials. The bulletin addresses Langflow versions 1.0.0 through 1.12.8 an…

Critical certificate-validation vulnerabilities have been identified in Incus and Canonical LXD, allowing unauthenticated attackers to impersonate trusted identities and compromise management infrastructure. Exploitation of these vulnerabilities requir…

Hackers exploited a chain of zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances, allowing them to execute commands with root access, steal credentials, and probe internal networks. Volexity has identified the unknown attacker as UTA…

WordPress released version 7.1.4 on October 28, 2026, which addresses 22 security vulnerabilities. Among them is an unauthenticated remote code execution flaw that attackers are actively exploiting. Administrators should ensure the update is installed,…

A critical flaw in the GoAhead embedded web server lets revoked client certificates pass authentication checks, potentially restoring access to identities administrators have blocked. Tracked as CVE-2026-115881, the vulnerability carries a CVSS score o…

KeePassXC has released version 2.8.0 to address multiple security vulnerabilities related to database imports, browser integration, SSH key handling, and the protection of sensitive information. Published on October 21, this update includes eight secur…

Apache Camel’s security advisories document critical and high-severity vulnerabilities that could allow for remote code execution, authentication bypass, credential exposure, and unauthorized file access. These issues affect various integration compone…

Security researchers have revealed multiple high-severity vulnerabilities in Tailscale and Headscale that could let attackers gain root access to connected servers, bypass network security policies, steal credentials, and disrupt remote-access infrastr…