threat-modeling-mcp-server

Threat Modeling MCP Server A Model Context Protocol MCP server for comprehensive threat modeling with guided code validation. Table of Contents Overview Quick Start Prompts Key Features Prerequisites Installation Running with Kiro CLI Output File Management Quick Reference Tools Overview Threat...

CVE-2026-9198

CVE-2026-9198 Причина уязвимости: IBM Langflow OSS — это программное обеспечение с открытым исходным кодом, предназначенное для построения и развертывания автоматизированных рабочих процессов агентов. В IBM Langflow OSS 1.0.0–1.10.0 по умолчанию включён автоматический вход autologin = true. В это...

langflow-exploit

CVE-2025-3248 - RCE в эндпоинте проверки кода Langflow Эксплойт типа proof-of-concept, демонстрирующий уязвимость удаленного выполнения кода в эндпоинте проверки кода Langflow. Эта уязвимость затрагивает версии Langflow до 1.3.0 и позволяет неаутентифицированным злоумышленникам выполнять...

CVE-2025-3248-Langflow-RCE

CVE-2025-3248 — Langflow: неаутентифицированное удалённое выполнение кода Proof-of-Concept эксплойт для CVE-2025-3248 — уязвимости неаутентифицированного удалённого выполнения кода в Langflow, платформе для создания рабочих процессов на базе ИИ/LLM. Затронутые версии: Langflow 1.3.0 Исправлено в:...

exposecheck

EXPOSECHECK Only run against servers you own or are authorized to test. Scope: a passing result means only that this narrow check found an authentication challenge and a Langflow version at or above the patched threshold for CVE-2025-3248. It is not a general security, reputation, configuration, ...

CVE-2026-9198

CVE-2026-9198 - Неаутентифицированный RCE в IBM Langflow через обход автоматического входа учебный PoC Этот репозиторий содержит учебный proof of concept для CVE-2026-9198 , затрагивающего IBM Langflow OSS. PoC poc.py демонстрирует, как неаутентифицированный злоумышленник может объединить в...

CLEANSTART-2026-RG79000 Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period

Security vulnerability affects the vault package. Vault and Vault Enterprise’s “Vault” TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period...

Protection Mechanism Failure

Overview mcp-contextforge-gateway is a ContextForge AI Gateway — an AI gateway, registry, and proxy for MCP, A2A, and REST/gRPC APIs. Exposes a unified control plane with centralized governance, discovery, and observability. Optimizes agent and tool calling, and supports plugins. Affected version...

Security Bulletin: Code Injection Vulnerability in Code Validation Endpoint

Summary A code injection vulnerability was identified in the code validation endpoint that allowed authenticated users to execute arbitrary code on the server. The vulnerability existed in the validation logic which compiled and executed function definitions to check for import errors. Attackers...

SUSE CVE-2026-68445

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4gemobjectmmap rejects a writable mapping of a validated shader BO, but leaves VMMAYWRITE set. Userspace can map the BO read-only and then turn it writable with mprotec...

langflow-exploit

CVE-2025-3248 - Langflow Code Validation Endpoint RCE A proof...

CVE-2026-17632 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning...

CVE-2026-17632

CVE-2026-17632 affects IBM Langflow OSS versions 1.0.0–1.10.3. The vulnerability arises from improper validation of Python code during AST-based security scanning, enabling a remote authenticated attacker to execute arbitrary code. The NVD/CVE listings report a high-severity vector with CVSS 3.1:...

CVE-2026-17632: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning...

CVE-2026-8481

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec function without sandboxing, input...

CVE-2026-8481 Remote Code Execution via Code Validation Endpoint

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec function without sandboxing, input...

CVE-2026-8481 Remote Code Execution via Code Validation Endpoint

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec function without sandboxing, input...

EUVD-2026-45275

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec function without sandboxing, input...

CVE-2026-9198 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/autologin mints SUPERUSER tokens to any network caller with /api/v1/validate/code executes user code via exec to achieve full RCE on default Langflow deployments...

CVE-2026-9198 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/autologin mints SUPERUSER tokens to any network caller with /api/v1/validate/code executes user code via exec to achieve full RCE on default Langflow deployments...