Lucene search
+L

1448 matches found

EUVD
EUVD
added 2026/09/14 9:31 p.m.3 views

EUVD-2026-77781

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication...

5.4CVSS
SaveExploits0References2
CVE
CVE
added 2026/09/14 9:30 p.m.39 views

CVE-2026-12944

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...

9.6CVSS
SaveExploits0References1
CVE
CVE
added 2026/09/14 8:32 p.m.19 views

CVE-2026-12763

IBM Langflow OSS (versions 1.0.0 through 1.11.5) is affected by improper cache key isolation in the MCP Tools component . The component caches discovered MCP tools in a shared process-local cache keyed only by the MCP server display name, without incorporating the user, session, flow, or resolved...

4.2CVSS
SaveExploits0References1
CVE
CVE
added 2026/09/14 8:31 p.m.25 views

CVE-2026-12765

IBM Langflow OSS versions 1.0.0 through 1.10.2 are vulnerable to server-side request forgery (SSRF) in several flow components, including LM Studio, Home Assistant, DeepSeek, xAI, Glean, HuggingFace Inference API, Ollama, LiteLLM, and Docling Serve. These components accept user-supplied URL value...

6.5CVSS
SaveExploits0References1
CVE
CVE
added 2026/09/14 8:29 p.m.16 views

CVE-2026-12766

IBM Langflow OSS (versions 1.0.0–1.11.2) is vulnerable to Server-Side Request Forgery (SSRF) across multiple components. The root cause involves missing or bypassable URL validation: the LMStudio and embeddings components pass a user-controlled base_url to httpx.AsyncClient without invoking the S...

5.4CVSS
SaveExploits0References1
CVE
CVE
added 2026/09/14 8:21 p.m.9 views

CVE-2026-12767

IBM Langflow OSS (versions 1.0.0 through 1.11.5) is affected by server-side request forgery (SSRF) due to missing egress validation on server-side URL fetches. The root cause involves specific connectors that bypass the platform's shared SSRF guard: the IBM Db2 Vector Store connector fetches a us...

6.5CVSS
SaveExploits0References1
NVD
NVD
added 2026/09/14 8:16 p.m.6 views

CVE-2026-17628

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication...

5.4CVSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/14 7:38 p.m.6 views

CVE-2026-17628 Langflow is affected by improper authentication due to missing password verification in the password reset endpoint

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication...

5.4CVSS
SaveExploits0References1
CVE
CVE
added 2026/09/14 7:38 p.m.12 views

CVE-2026-17628

IBM Langflow OSS versions 1.0.0 through 1.10.2 are affected by improper authentication (CWE-287) in the password reset endpoint. The endpoint accepts a current-password field in the request body but does not verify it against the stored credential before applying the change, and enforces no passw...

5.4CVSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/14 12:28 p.m.9 views

CVE-2026-33017-Langflow-RCE

root@kitploit: ██╗ ██╗ ██████╗ ███████╗███████╗ ██████╗ ██████╗ ██████╗ ███████╗ ██║ ██║██╔═══██╗██╔════╝██╔════╝██╔═══██╗██╔══██╗██╔═══██╗██╔════╝ ██║ ██║██║ ██║███████╗███████╗██║ ██║██║ ██║██║ ██║███████╗ ╚██╗ ██╔╝██║ ██║╚════██║╚════██║██║ ██║██║ ██║██║ ██║╚════██║ ╚████╔╝...

9.8CVSS8.3AI score0.96177EPSS
SaveExploits33
Kitploit
Kitploit
added 2026/09/14 12:28 p.m.8 views

PoC-CVE-2026-9198

Descripción Código de exploit de prueba de concepto para CVE-2026-9198 Entrada en Exploit-DB: https://www.exploit-db.com/exploits/52675 Uso python3 poc.py -u -c...

9.8CVSS9AI score0.60597EPSS
SaveExploits9
Kitploit
Kitploit
added 2026/09/14 12:16 p.m.9 views

langflow-CVE-2026-33017-poc

CVE-2026-33017 — PoC de RCE no autenticada en Langflow Solo para fines educativos y pruebas autorizadas. Resumen Langflow = 1.8.1 expone un endpoint público de construcción de flujos que acepta datos de flujo controlados por el atacante y que contienen código arbitrario. Ese código se pasa a...

9.8CVSS8.4AI score0.96177EPSS
SaveExploits33
Kitploit
Kitploit
added 2026/09/14 11:29 a.m.7 views

CVE-2026-33017

CVE-2026-33017 - RCE no autenticado en Langflow ⚠️ AVISO: Este repositorio es solo para pruebas de seguridad autorizadas y fines educativos. Úselo solo en sistemas de su propiedad o para los que tenga permiso explícito. El autor no se hace responsable del mal uso o daños causados por esta...

9.8CVSS8.4AI score0.96177EPSS
SaveExploits33References1
Kitploit
Kitploit
added 2026/09/14 11:12 a.m.4 views

CVE-2026-33017

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow PoC de Ejecución Remota de Código ★ https://github.com/user-attachments/assets/562fc637-6be1-4ab9-a396-bfad56447af7 Configuración del Entorno Utilice los siguientes comandos para construir y ejecutar el entorno vulnerable de Langflow:...

9.8CVSS8.4AI score0.96177EPSS
SaveExploits33References3
Kitploit
Kitploit
added 2026/09/14 8:59 a.m.9 views

CVE-2025-3248

CVE-2025-3248 – Ejecutar código Python arbitrario en un servidor Langflow vulnerable. Descubierto por: Naveen Sunkavally, Horizon3.ai Estado: Divulgación pública Fecha de reporte: 2025-04-07 ID de CVE: CVE-2025-3248 🧾 Captura de pantalla 🧩 Resumen Se ha descubierto una falla crítica en Langflow q...

9.8CVSS8.4AI score0.9999EPSS
SaveExploits37
Kitploit
Kitploit
added 2026/09/14 8:49 a.m.6 views

CVE-2025-3248

CVE-2025-3248: Langflow Unauthenticated Remote Code Execution RCE This repository contains two Python scripts: LangflowCheck.py: A scanner that checks for Langflow AI instances vulnerable to CVE-2025-3248. exploit.py: A working reverse shell exploit for vulnerable Langflow targets. Summary...

9.8CVSS8.4AI score0.9999EPSS
SaveExploits37
Kitploit
Kitploit
added 2026/09/14 7:33 a.m.6 views

CVE-2025-3248

POC - Un atacante remoto y no autenticado puede enviar solicitudes HTTP manipuladas para ejecutar código arbitrario - CVE-2025-3248 Resumen Las versiones de Langflow anteriores a 1.3.0 son susceptibles a la inyección de código en el endpoint /api/v1/validate/code. Un atacante remoto y no...

9.8CVSS8.4AI score0.9999EPSS
SaveExploits37References1
Kitploit
Kitploit
added 2026/09/14 6:27 a.m.4 views

CVE-2025-3248

CVE-2025-3248 ★ CVE-2025-3248 PoC de RCE de Langflow ★ Configuración del Laboratorio root@kitploit: docker pull langflowai/langflow:1.2.0 docker run -d --name CVE-2025-3248 -p 7860:7860 langflowai/langflow:1.2.0 localhost:7860 Descripción Las versiones de Langflow anteriores a la 1.3.0 son...

9.8CVSS8.9AI score0.9999EPSS
SaveExploits37
Kitploit
Kitploit
added 2026/09/14 5:51 a.m.5 views

Mass-CVE-2025-3248

Langflow CVE-2025-3248 Exploit Tool Overview This tool exploits the critical Remote Code Execution RCE vulnerability CVE-2025-3248 found in Langflow versions prior to 1.3.0. The vulnerability exists in the /api/v1/validate/code endpoint which improperly executes user-supplied code without...

9.8CVSS8.4AI score0.9999EPSS
SaveExploits37
Kitploit
Kitploit
added 2026/09/14 5:33 a.m.6 views

CVE-2025-3248

Exploit de Langflow CVE-2025-3248 Un exploit basado en Python para CVE-2025-3248, que permite a atacantes remotos no autenticados ejecutar código arbitrario en instancias vulnerables de Langflow mediante solicitudes HTTP manipuladas. Características Escaneo de URL única o masivo desde archivo...

9.8CVSS8.5AI score0.9999EPSS
SaveExploits37References1
Rows per page
Query Builder