APDPO

Asia-Pacific Data Privacy Organization

apdpo.com

85%

of Asia-Pacific jurisdictions have enacted or drafted personal data protection laws.

46%

of APAC countries have dedicated national data protection authorities.

35%

of jurisdictions require mandatory breach notifications.

19%

have cross-border data transfer laws modeled after the GDPR.

31%

have issued official AI ethics or governance frameworks.

90%

of large enterprises in APAC are subject to multi-jurisdictional data compliance obligations.

Training Access

Priority early registration for regional and role-specific training ahead of public release.

Certification Discounts

Reduced rates on APDPO certifications compared to standard rates for non-members.

Skills Development

Practical guidance from foundational policies through international alignment.

Co-Branding

Joint events and certifications, plus logos on the APDPO website and member microsites.

2026-02-26

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent node in Langflow hardcodes `allow_dangerous_code=True`, which automatically exposes LangChain’s Python REPL tool (`python_repl_ast`). As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection, leading to full Remote Code Execution (RCE). Version 1.8.0 fixes the issue.

2026-02-26

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the manifest — which may be files that they have also added to the manifest and backup contents — are written to any accessible location on restore. This is a common path traversal security issue. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment — allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. No known workarounds are available.

2026-02-26

OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged `GITHUB_TOKEN` and numerous sensitive secrets (API keys, database/vector store tokens, and a Google Cloud service account key). Version 1.37.1 contains a fix.

2026-02-26

Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter.

2026-02-25

Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

2026-02-23

Video Insight VMS versions prior to 7.6.1 allow remote attackers to conduct code injection attacks via unspecified vectors.

2026-02-21

Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability.

2026-02-21

An attacker could send a crafted HTTP/HTTPS request to render the web server unavailable and/or lead to remote code execution caused by a stack-based buffer overflow vulnerability. A cold restart is required for recovering CompactLogix 5370 L1, L2, and L3 Controllers, Compact GuardLogix 5370 controllers, and Armor Compact GuardLogix 5370 Controllers Versions 20 - 30 and earlier.