CVE-2026-79742: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist...

PT-2026-89619

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description A remote authenticated attacker can execute arbitrary code because of an incomplete environment variable blocklist. A blocklist is a security mechanism that prevents the use of specifi...

CVE-2026-84889: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...

PT-2026-89629

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description Improper validation of user-supplied URLs allows a remote attacker to obtain sensitive information from internal network resources. This issue is a Server-Side Request Forgery SSRF,...

CVE-2026-9225: Authorization Bypass Through User-Controlled Key

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...

CVE-2026-78575: Improper Neutralization of Special Elements used in an OS Command

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration...

PT-2026-89612

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description A remote authenticated attacker can execute arbitrary code because of an unguarded eval function call that processes input controlled by the attacker. Recommendations Update IBM Langfl...

CVE-2026-78571: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval call on attacker-controlled input...

CVE-2026-81211: Missing Authorization

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...

Security Bulletin: Langflow is affected by improper authentication due to missing password verification in the password reset endpoint

Summary Langflow provides a password reset capability through its user management API. The password reset endpoint accepts a current password field in the request body but does not verify it against the stored credential before applying the password change, and enforces no password complexity...

Security Bulletin: Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

Summary Langflow and its bundled connectors perform server-side HTTP requests using URLs supplied by authenticated users without consistently applying the platform's connector SSRF validation guard. The MCP server configuration URL field accepts any HTTP or HTTPS target including RFC 1918,...

Security Bulletin: A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem

Summary A path traversal vulnerability existed in two independent file handling mechanisms used by the product's workflow execution and file management capabilities. The file upload endpoint accepted multipart filenames directly from HTTP request metadata without sanitization, allowing an...

OSV-2026-1239 Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=557292360 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.copyOfSubArray org.apache.lucene.util.BytesRef.deepCopyOf org.apache.lucene.index.Term...

OSV-2026-1235 UNKNOWN READ in renumber_by_map

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=557283672 Crash type: UNKNOWN READ Crash state: renumberbymap renumberbymap disablenonamegroupcapture...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073358)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073358 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix setup list UAF on proc write error sndpcmossprocwrite links a newly allocated...

CVE-2026-17621

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

CVE-2026-17622

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...

CVE-2026-17627

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization...

CVE-2026-17631

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery SSRF vulnerability...

CVE-2026-14470

IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...