99586 matches found
EUVD-2026-71270
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal...
CVE-2026-19299 Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal...
EUVD-2026-71269
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links...
EUVD-2026-71266
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy...
CVE-2026-19304
IBM Langflow OSS versions 1.0.0 through 1.11.2 are affected by a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) caused by a URL parser discrepancy in the validate_url_for_ssrf guard. On the RSSReaderSimple and SearXNGToolComponent components, backslash-containing URLs allow an attacke...
CVE-2026-19304 Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy...
EUVD-2026-71262
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery...
CVE-2026-19305 Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery...
CVE-2026-19305
IBM Langflow OSS versions 1.0.0 through 1.11.2 are vulnerable to Server-Side Request Forgery (SSRF) (CWE-918) in multiple components where a remote attacker with no prior authentication can supply attacker-controlled URLs that reach internal network hosts without adequate validation. Affected com...
EUVD-2026-71260
IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material secretkey, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories — by supplying absolute pat...
CVE-2026-19645 Multiple vulnerabilities in IBM MQ Agent images
IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods — rangingfrom tens of seconds to over ten minutes per request. When...
CVE-2026-19645 Multiple vulnerabilities in IBM MQ Agent images
IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods — rangingfrom tens of seconds to over ten minutes per request. When...
CVE-2026-19645
IBM MQ Agent images (CD versions v1.0.0, v1.0.1, v2.0.0, v2.0.1) are affected by a vulnerability where an authenticated user with a valid session cookie can submit arbitrarily large or computationally expensive requests that hold LLM agent workers for extended periods—ranging from tens of seconds...
CVE-2026-19649
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, as well as IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7, are vulnerable to information disclosure due to improper logging of database credentials in Adapter nodes. A local attacker with no req...
EUVD-2026-71258
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of database credentials...
CVE-2026-19649 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of database credentials...
CVE-2026-19649 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of database credentials...
CVE-2026-9186
IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1 header, enabling arbitrary writes to IDE config files /.cursor/mcp.json, etc...
CVE-2026-9138
IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attacker‑controlled input without sufficient sanitization when...