20598 matches found
CVE-2026-17633
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection...
CVE-2026-17632
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning...
CVE-2026-17624
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of module imports...
CVE-2026-17624 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of module imports...
CVE-2026-9196
IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user...
CVE-2026-9201
IBM Langflow OSS 1.0.0–1.10.3 is affected by an authenticated arbitrary code execution vulnerability in the custom component validation mechanism. The hardening mode that restricts execution to trusted templates validates component code using a truncated SHA-256 digest, causing only a portion of ...
CVE-2026-8478 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code...
CVE-2026-8183
Langflow OSS is affected (versions 1.0.0–1.10.3) by a vulnerability described as remote directory traversal via crafted URLs containing dot-dot sequences ( /.. / ), enabling access to arbitrary files on the system. The Connected CVE entry corroborates the affected versions and the traversal vecto...
CVE-2026-8183
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot "...
EUVD-2026-53554
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot "...
CVE-2026-7657
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery SSRF due to incomplete and ineffective SSRF protection enforcement...
CVE-2026-9130
CVE-2026-9130 affects IBM Langflow OSS versions 1.0.0–1.10.3. The root cause is an authorization bypass in the MemoryComponent where session_id is used to filter messages without validating flow_id or user_id ownership, enabling cross‑user information disclosure. This impacts multi‑user deploymen...
CVE-2026-9130 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...
EUVD-2026-53549
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for...
CVE-2026-9205
IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...
CVE-2026-7657 Langflow OSS is affected by server-side request forgery in provider validation and API request functionality
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery SSRF due to incomplete and ineffective SSRF protection enforcement...
CVE-2026-7657
IBM Langflow OSS versions 1.0.0–1.10.3 are affected by server-side request forgery (SSRF) due to incomplete and ineffective SSRF protection enforcement. The CVSS vector indicates network access with low attack complexity, requiring low privileges and no user interaction, with a high confidentiali...
EUVD-2026-53520
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special element...