1141532 matches found
CVE-2026-81211 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...
CVE-2026-81941
IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to arbitrary operating system command execution when an authenticated non-administrative user constructs a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_CO...
CVE-2026-81941 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess...
CVE-2026-81550 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
CVE-2026-81550
IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an OS command injection vulnerability caused by improper neutralization of special elements used in an OS command. A remote authenticated attacker can leverage this flaw to execute arbitrary code , resulting in high impact to confidential...
CVE-2026-81940
CVE-2026-81940 affects IBM Langflow OSS versions 1.0.0 through 1.11.5 , where improper neutralization of special characters in flow display names permits a remote authenticated attacker to execute arbitrary code. The underlying cause is classified as CWE-94 (Code Injection) : attacker-controlled ...
CVE-2026-81940 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names...
CVE-2026-82095
IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an OS command injection vulnerability caused by improper neutralization of special elements in an OS command, allowing a remote authenticated attacker to execute arbitrary code. The vulnerability scores CVSS 3.1 8.8 (High) with network at...
CVE-2026-82095 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
CVE-2026-82097
IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that allows a remote authenticated attacker to execute arbitrary code . The IBM-assigned CVSS 3.1 base score is 8.8 (HIGH) , with network attack vector, low complexity, and high...
CVE-2026-82097 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery SSRF vulnerability...
CVE-2026-82099 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
CVE-2026-82099
CVE-2026-82099 affects IBM DataStage on Cloud Pak for Data 5.4.0.0 , where a remote authenticated attacker can execute arbitrary code due to OS command injection (CWE-78) — improper neutralization of special elements in an OS command. The vulnerability is network-exploitable with low complexity a...
CVE-2026-84889 A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...
CVE-2026-84889
IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a path traversal vulnerability (CWE-22) in two independent file handling mechanisms. First, the file upload endpoint accepted multipart filenames from HTTP request metadata without sanitization, allowing directory traversal sequences in the C...
NPM: OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
NPM: OmniRoute ACP Custom-Agent Remote Code Execution RCE vulnerability discovered by ? in WordPress Npm omniroute versions = 3.8.50...
OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
Summary POST /api/acp/agents registers a custom ACP agent. The endpoint accepts user-controlled binary and versionCommand values. After saving the custom agent, the same request calls refreshAgentCache, which triggers agent version detection. The version probe eventually runs: ts...
CVE-2026-89094
Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...
CVE-2026-85025
IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls...