What you need to know today.

Craft CMS SSRF and JavaScript injection (CVE-2026-55791) — A critical server-side request forgery and arbitrary JavaScript injection vulnerability in Craft CMS's /actions/app/resource-js endpoint allows unauthenticated attackers to bypass access controls. The flaw exploits the default permissive trustedHosts configuration, enabling an attacker to craft requests that reach internal services or inject malicious JavaScript into the application context. Given Craft CMS's widespread use in content management, this vulnerability could lead to data exfiltration, lateral movement within hosting environments, or full site compromise. No patch details have been released as of this writing; administrators should immediately review their trustedHosts configuration and restrict access to the affected endpoint.

Langflow AI: Four critical and high-severity flaws disclosed (CVE-2026-55447, CVE-2026-55255, CVE-2026-55446) — Langflow, the popular low-code AI development platform, had four vulnerabilities disclosed together, two rated critical. CVE-2026-55447 affects all components based on BaseFileComponent — including Docling, Docling Serve, Read File, and the NVIDIA Retriever — enabling arbitrary file reads. CVE-2026-55255 is an Insecure Direct Object Reference (IDOR) in the /api/v1/responses endpoint that lets an authenticated attacker execute any flow belonging to another user by simply specifying the victim's flow ID. CVE-2026-55446 allows an unauthenticated attacker to send a /api/v1/files/upload/ request with an extremely long multipart form boundary, rendering the application unusable for all users indefinitely. As Vypr Intelligence reported, these bugs collectively expose Langflow deployments to data theft, cross-tenant access, and denial of service. Users should update to the latest patched version immediately.

CoreWCF critical SAML authentication bypass (CVE-2026-54782) — A critical vulnerability in CoreWCF, the .NET Core port of Windows Communication Foundation, allows full impersonation of any principal the trusted Security Token Service (STS) could have issued an assertion for — including administrative principals when the relying party grants them via SAML claims. The flaw affects both SAML 1.1 and SAML 2.0 implementations and requires no special preconditions beyond the ability to reach the STS endpoint. As Vypr Intelligence noted, this was one of 13 CVEs disclosed in a single day for CoreWCF, making it a significant supply-chain concern for any .NET application relying on SAML-based federation. Organizations using CoreWCF for authentication should treat this as an emergency patch priority.

Home Assistant Konnected integration unauthenticated endpoint (CVE-2026-54317) — The Konnected integration in Home Assistant registers an HTTP endpoint (KonnectedView) that is explicitly marked as not requiring authentication (requires_auth = False). A comment in the source code next to that line indicates the developer was aware of this design choice. This unauthenticated endpoint exposes home automation control surfaces — including alarm systems, sensors, and switches — to any attacker who can reach the Home Assistant instance on the network. Given that Home Assistant is often deployed on local networks with port forwarding or cloud connectivity, this vulnerability could allow remote attackers to disarm alarms, manipulate smart locks, or monitor sensor data. Users should ensure Home Assistant is not exposed to the internet without a reverse proxy and authentication layer, and apply any available update from the Konnected integration maintainers.

Oj JSON parser: Heap corruption, use-after-free, and buffer overflow cluster (CVE-2026-54903, CVE-2026-54902, CVE-2026-54901, CVE-2026-54900, CVE-2026-54898, CVE-2026-54897, CVE-2026-54896, CVE-2026-54592, CVE-2026-54502, CVE-2026-54899) — A cluster of ten high-severity vulnerabilities was disclosed in the Oj JSON parser for Ruby, covering heap corruption, use-after-free, stack buffer overflows, and integer truncation issues. Notable among them: CVE-2026-54903 causes heap corruption when parsing JSON strings longer than 2 GB due to an integer overflow in buf_append_string; CVE-2026-54900 triggers heap corruption via a negative-size memcpy when a JSON object key is exactly 65,535 bytes long; and CVE-2026-54898 allows a heap use-after-free when a SAJ/SAJ2 callback mutates the input JSON string during parsing. Several other CVEs involve garbage collection races and stack overflows in deeply nested documents. Given Oj's widespread use in Ruby web applications and API services, this cluster represents a significant attack surface for denial of service, memory corruption, and potentially remote code execution. Developers should update to the latest Oj version and audit any code that parses untrusted JSON with Oj.

Symfony UX recipe kit path traversal (CVE-2026-55878) — The ux:install console command in Symfony UX installs files from a recipe kit by copying paths listed in a copy-files map. The only guard against malicious paths was Path::isRelative(), which returns true for paths like ../../../etc/passwd, enabling a path traversal attack. An attacker who can supply a malicious recipe kit — for example, through a compromised Composer package or a typosquatted dependency — could overwrite arbitrary files on the system, potentially achieving code execution by overwriting application bootstrap files or configuration. This vulnerability highlights the risks of supply-chain attacks in the PHP ecosystem. Developers should validate the integrity of any recipe kits used with Symfony UX and apply the patch as soon as it becomes available.