CVE-2026-81211 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...

CVE-2026-81211 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...

CVE-2026-81211

IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to arbitrary Python code execution by a remote authenticated attacker. The root cause is a missing authorization check (CWE-862): the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY policy is enforced on the direct custom-component endpoint but n...

CVE-2026-81211: Missing Authorization

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...

PT-2026-89628

🚨 CVE-2026-81211 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows. 🎖@cveNotify...

CVE-2026-19300 Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields...

CVE-2026-19294

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization...

CVE-2026-19294

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization...

CVE-2026-19294

IBM Langflow OSS versions 1.0.0 through 1.11.1 are affected by an improper authorization flaw (CWE-639). Deprecated build endpoints remain fully routed but lack the object-level ownership check present on the modern equivalent endpoint, allowing any authenticated user to enumerate and execute ano...

CVE-2026-18891: Improper Authentication

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Check for the NOTREADY flag state after locking Currently, the check for the NOTREADY flag is performed before obtaining the necessary lock. This creates a possibility for race conditions when the flow is concurrently...

CVE-2026-76245: Insufficient Verification of Data Authenticity

stigmem pip package stigmem-node version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using...

Malicious code in @or-sdk/flows (npm)

npm/@or-sdk/flows is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...

EUVD-2026-47050

Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite component: Site Hierarchy Flows. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Site Hub. Successful...

CVE-2026-60697

Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite component: Site Hierarchy Flows. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Site Hub. Successful...

CVE-2026-60697: Improper Access Control

Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite component: Site Hierarchy Flows. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Site Hub. Successful...

PT-2026-62727

Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite component: Site Hierarchy Flows. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Site Hub. Successful...

axios: Axios: Information disclosure of proxy credentials via redirect flows

A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...

axios: Axios: Information disclosure of proxy credentials via redirect flows

A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2026:42078)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42078 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...