jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-base (>=0.10.0rc0, <=0.10.0) potentially affected by CVE-2026-105697 +1 more via lfx (1.10.0)

lfx PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - jf-langflow =1.10.0, =0.10.0rc0, =0.10.0 Source cves: CVE-2026-105697, CVE-2026-105740 Source advisory: OSV:GHSA-W794-RJ3P-XV45...

langflow-base (>=0.9.0, <=0.9.6) potentially affected by CVE-2026-105697 +1 more via lfx (0.4.6)

lfx PYPI version 0.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - langflow-base =0.9.0, =0.9.6 Source cves: CVE-2026-105697, CVE-2026-105740 Source advisory: OSV:GHSA-W794-RJ3P-XV45...

langflow-base (>=0.8.0rc0, <=0.8.4) potentially affected by CVE-2026-105697 +1 more via lfx (0.3.4)

lfx PYPI version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - langflow-base =0.8.0rc0, =0.8.4 Source cves: CVE-2026-105697, CVE-2026-105740 Source advisory: OSV:GHSA-W794-RJ3P-XV45...

langflow-base (>=0.7.0, <=0.7.2), langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-105697 +1 more via lfx (0.2.1)

lfx PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - langflow-base =0.7.0, =0.7.2 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-105697, CVE-2026-105740 Source advisory: OSV:GHSA-W794-RJ3P-XV45...

dzbanek-langflow-base (>=0.6.0, <=0.6.1) potentially affected by CVE-2026-105697 +1 more via lfx (0.1.13)

lfx PYPI version 0.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - dzbanek-langflow-base =0.6.0, =0.6.1 Source cves: CVE-2026-105697, CVE-2026-105740 Source advisory: OSV:GHSA-W794-RJ3P-XV45...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-105697 +1 more via langflow-base (>=0.7.2, <=0.10.0)

langflow-base PYPI version =0.7.2, =1.10.0, =1.10.0.post7 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-105697, CVE-2026-105740 Source advisory: OSV:GHSA-W794-RJ3P-XV45...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-105697 via langflow-base (>=0.7.2, <=0.10.0)

langflow-base PYPI version =0.7.2, =1.10.0, =1.10.0.post7 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-105697 Source advisory: GHSA-W794-RJ3P-XV45...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-105698 via langflow-base (>=0.7.2, <=0.10.0)

langflow-base PYPI version =0.7.2, =1.10.0, =1.10.0.post7 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-105698 Source advisory: OSV:GHSA-GH98-4PHW-6FMW...

ai.catboost:catboost-spark_3.0_2.12 (>=0.25, <=1.2.8), ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1, <=1.2.8) +12361 more potentially affected by CVE-2026-106451 via org.lz4:lz4-java (>=1.7.0, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.7.0, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =0.0.115 and more Source cves: CVE-2026-106451 Source advisory: SNYK:JAVA-ORGLZ4-20570515...

EUVD-2026-93868

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3758 more potentially affected by CVE-2026-106451 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.3)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-106451 Source advisory: SNYK:JAVA-ATYAWKLZ4-20570516...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3758 more potentially affected by CVE-2026-106451 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.3)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-106451 Source advisory: OSV:GHSA-MCR4-QMVW-PX4G...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3758 more potentially affected by CVE-2026-106451 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.3)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-106451 Source advisory: GHSA-MCR4-QMVW-PX4G...

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

Summary When no system-installed liblz4-java is found, net.jpountz.util.Native.load extracts the bundled native library to java.io.tmpdir and loads it with System.load. The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive...

ai.catboost:catboost-spark_3.0_2.12 (>=0.25, <=1.2.8), ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1, <=1.2.8) +12361 more potentially affected by CVE-2026-106451 via org.lz4:lz4-java (>=1.7.0, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.7.0, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =0.0.115 and more Source cves: CVE-2026-106451 Source advisory: OSV:GHSA-MCR4-QMVW-PX4G...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3758 more potentially affected by CVE-2026-106449 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.3)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-106449 Source advisory: GHSA-343H-94H5-C4WR...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15576 more potentially affected by CVE-2026-106449 via org.lz4:lz4-java (>=1.4, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2026-106449 Source advisory: GHSA-343H-94H5-C4WR...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3758 more potentially affected by CVE-2026-106449 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.3)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-106449 Source advisory: OSV:GHSA-343H-94H5-C4WR...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3758 more potentially affected by CVE-2026-106449 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.3)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-106449 Source advisory: SNYK:JAVA-ATYAWKLZ4-20570528...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15576 more potentially affected by CVE-2026-106450 via org.lz4:lz4-java (>=1.4, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2026-106450 Source advisory: GHSA-GM45-99XC-R7WV...