CVE-2026-7667: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted Content-Disposition header e.g., filename="../../../target/path" , enabling arbitrary file write operations with...

CVE-2026-8481: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec function without sandboxing, input...

PT-2026-60834

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description Improper authentication and access control in the user registration and account provisioning logic allow unauthenticated attackers to create unlimited user accounts. This occurs when...

CVE-2026-13448: Incomplete List of Disallowed Inputs

IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint /api/v1/buildpublictmp/flowid/flow . The vulnerability stems from an incomplete denylist in the validatepublicflownocodeexecution function that fails...

CVE-2026-13445: Authorization Bypass Through User-Controlled Key

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths pointing to victim storage locations. In append mode, the attacker's workflow reads victim file contents,...

CVE-2026-8859: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the APIRequest component. A path traversal vulnerability exists when the "Save to File" feature is enabled, where filenames extracted from HT...

CVE-2026-9202: Missing Authentication for Critical Function

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEWUSERISACTIVE=true documented deployment option, newly created accounts are immediately active and can authenticate to reach RCE endpoints, bypassing the need...

CVE-2026-8505: Missing Authentication for Critical Function

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False which is the default...

clusterfuzz v2.35.0

ClusterFuzz ClusterFuzz is a scalable fuzzing infrastructure that finds security and stability issues in software. Google uses ClusterFuzz to fuzz all Google products and as the fuzzing backend for OSS-Fuzz. ClusterFuzz provides many features which help seamlessly integrate fuzzing into a softwar...

clusterfuzz v2.34.0

ClusterFuzz ClusterFuzz is a scalable fuzzing infrastructure that finds security and stability issues in software. Google uses ClusterFuzz to fuzz all Google products and as the fuzzing backend for OSS-Fuzz. ClusterFuzz provides many features which help seamlessly integrate fuzzing into a softwar...

Fedora 45 : fasterxml-oss-parent / jackson-annotations / jackson-bom / etc (2026-ddde3cf003)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-ddde3cf003 advisory. Rebase to 2.21.5 to solve the CVE-2026-54518, CVE-2026-54517, CVE-2026-54516, CVE-2026-54515, CVE-2026-54513, CVE-2026-54512 Tenable has extracted t...

clusterfuzz v2.33.14

ClusterFuzz ClusterFuzz is a scalable fuzzing infrastructure that finds security and stability issues in software. Google uses ClusterFuzz to fuzz all Google products and as the fuzzing backend for OSS-Fuzz. ClusterFuzz provides many features which help seamlessly integrate fuzzing into a softwar...

Security Bulletin: Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure

Summary The Python Interpreter component and legacy Python REPL Tool component provided flow and agent authors the ability to execute Python code within a scoped globals environment restricted to an operator-configured import allow-list and curated safe builtins. An attacker who could provide inp...

HPESBNW05080 rev.1 - HPE Unified OSS Console (UOC) and HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities

Potential Security Impact: Local: Authentication Bypass, Gain Unauthorized Access, Session Reuse, Input Validation; Remote: Authentication Bypass, Gain Unauthorized Access, Session Reuse, Input Validation SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified OSS Console UOC...

Open Babel has heap buffer overflow in SMILES OBSmilesParser::ParseSmiles

SummaryA memory-safety vulnerability in Open Babel's SMILES parser caused aheap buffer overflow when reading a crafted input string. DetailsThe flaw was in OBSmilesParser::ParseSmiles. A malformed SMILESinput caused the parser to write past the end of a heap-allocatedbuffer. ImpactOpen Babel is a...

Open Babel has heap buffer overflow in ChemKin ChemKinFormat::CheckSpecies

SummaryA memory-safety vulnerability in Open Babel's ChemKin parser causeda heap buffer overflow when reading a crafted input file. DetailsThe flaw was in ChemKinFormat::CheckSpecies. A malformed speciesrecord caused the parser to write past the end of a heap-allocatedbuffer. ImpactOpen Babel is ...

PYSEC-2026-2432 Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

Summary The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would...

PT-2026-59108

Summary The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would...

freerdp:TestFuzzChannelRail: Heap-buffer-overflow in _wcsnlen

Project: https://github.com/FreeRDP/FreeRDP.git Detailed Report: https://oss-fuzz.com/testcase?key=5268164724981760 Project: freerdp Fuzzing Engine: libFuzzer Fuzz Target: TestFuzzChannelRail Job Type: libfuzzerasanfreerdp Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

OSV-2026-1054 Heap-buffer-overflow in ihevcd_cabac_decode_bins_tunary

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=533053032 Crash type: Heap-buffer-overflow READ 4 Crash state: ihevcdcabacdecodebinstunary ihevcdparsetransformtree ihevcdparsetransformtree...