cve-2026-33067

CVE-2026-33017 — Plantilla Nuclei para RCE sin autenticación en Langflow Plantilla Nuclei que detecta CVE-2026-33017 — una vulnerabilidad de ejecución remota de código sin autenticación en Langflow ≤ 1.8.2 accesible a través del endpoint público de construcción de flujos: root@kitploit: POST...

CVE-2026-33017-langflow-rce

CVE-2026-33017 — Langflow Unauthenticated Remote Code Execution RCE Overview CVE ID: CVE-2026-33017 Affected Software: Langflow Vulnerable Versions: = 1.9.0 Severity: Critical Author: r3nsi15 Date: 2026 Description Langflow exposes a public flow build endpoint /api/v1/buildpublictmp/flowID/flow...

CVE-2026-33017

CVE-2026-33017 - Langflow Unauthenticated RCE ⚠️ DISCLAIMER: This repository is for authorized security testing and educational purposes only. Use only on systems you own or have explicit permission to test. The author is not responsible for any misuse or damage caused by this tool. Overview...

CVE-2026-33017-Lab

CVE-2026-33017 — Langflow Unauthenticated RCE Labor Zusammenfassung CVE-2026-33017 ist eine Unauthenticated Remote Code Execution RCE -Schwachstelle in Langflow, bei der ein öffentlicher Build-Endpunkt vom Angreifer kontrollierte Flow-Daten akzeptiert und dadurch die Ausführung von...

CVE-2026-33017-Exploit

CVE-2026-33017 - Esecuzione Remota di Codice Non Autenticata in Langflow root@kitploit: / \ | | \ ^ / ||||| exec senza autenticazione, senza sandbox, senza speranza. Langflow chat.py - startflowbuild - buildgraphfromdata - Graph.frompayload - loading.py - eval.py createclass - validate.py...

IBM Langflow OSS authorization issue vulnerability (CNVD-2026-31200)

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to...

K000162377: Langflow vulnerability CVE-2026-33017

Security Advisory Description Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/buildpublictmp/flowid/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied...

CVE-2026-13448 Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint /api/v1/buildpublictmp/flowid/flow . The vulnerability stems from an incomplete denylist in the validatepublicflownocodeexecution function that fails...

EUVD-2026-45308

IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint /api/v1/buildpublictmp/flowid/flow . The vulnerability stems from an incomplete denylist in the validatepublicflownocodeexecution function that fails...

PT-2026-60871

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.1 Description An unauthenticated remote code execution issue exists in the public flow build endpoint '/api/v1/build public tmp/flow id/flow'. The flaw is caused by an incomplete denylist within the...

Exploit for Eval Injection in Langflow

CVE-2026-33017 - Langflow RCE Vulnerability xpl0ited by infr...

Exploit for Code Injection in Langflow

CVE-2026-33017 — Langflow Unauthenticated Remote Code Executio...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is vulnerable to cache poisoning if the image is built FROM scratch. Additionally, changes to certain instructions—especially HEALTHCHECK and ONBUILD—do not trigger cache...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: docker (UTSA-2026-017338)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017338 advisory. Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is...

CVE-2026-33017 Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/buildpublictmp/flowid/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses...

VulnCheck KEV: CVE-2026-33017

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/buildpublictmp/flowid/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses...

EUVD-2021-8631

Malicious code in bioql PyPI...

CVE-2021-21248

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job paramete...

CVE-2024-40541

my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/dept/build...

Cross-site Scripting (XSS)

silverstripe/framework is vulnerable to Cross-site Scripting XSS. The vulnerability is due to an unvalidated returnURL parameter in the dev/build endpoint, which can cause users to be redirected to unverified third-party URLs...