9734 matches found
CVE-2026-14470 Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components
IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...
CVE-2026-14470
IBM Langflow OSS versions 1.0.0 through 1.10.2 is vulnerable to a path traversal flaw (CWE-22) in its file and knowledge base components. An authenticated attacker can send a crafted URL request containing ../ sequences to read arbitrary files on the system. Per the IBM security bulletin, in the ...
CVE-2026-14470 Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components
IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...
EUVD-2026-71491
IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...
EUVD-2026-71466
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization...
CVE-2026-17621
IBM Langflow OSS versions 1.0.0 through 1.10.2 are affected by a path traversal vulnerability (CWE-22) in its file and knowledge base components. The root cause involves user-supplied path values not being validated against /../ sequences in the Directory component, the Knowledge Base connector i...
EUVD-2026-71464
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...
CVE-2026-17621 Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...
CVE-2026-17621 Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...
EUVD-2026-71463
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...
CVE-2026-17622
IBM Langflow OSS versions 1.0.0 through 1.10.2 are affected by path traversal (CWE-22) vulnerabilities across three components: the Directory component, the Knowledge Base connector ingestion endpoint, and the Knowledge Base flow component. In the Directory component, user-supplied paths are not ...
CVE-2026-17622 Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...
CVE-2026-17631 Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery SSRF vulnerability...
EUVD-2026-71462
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery SSRF vulnerability...
CVE-2026-17631 Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery SSRF vulnerability...
CVE-2026-17631
Langflow OSS 1.0.0–1.10.2 is vulnerable to a non-blind server-side request forgery (SSRF) (CWE-918) caused by missing URL validation in flow components for LM Studio, Home Assistant, DeepSeek, xAI, Glean, HuggingFace Inference API, Ollama, LiteLLM, and Docling Serve. An authenticated attacker can...
CVE-2026-19303
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory...
CVE-2026-19305
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery...