Notepad++ v8.8.1 - Privilege Escalation

Remote code execution in React Server Components and Next.js

An improper neutralization of special elements used in an SQL command (SQLI) vulnerability [CWE-89] in Fortinet FortiWeb version 7.6.0

Insufficient input validation leading to memory overread

Langflow exposes a /api/v1/builder/execute_code endpoint that takes user-supplied Python code and passes it directly to exec() on the backend. Since there's no authentication or sandboxing, attackers can craft arbitrary payloads for code execution.

Unauthenticated RCE vulnerability affecting the XWiki