14 matches found
CVE-2026-12946 Remote Code Execution in CUGA Component CodeAgent
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code...
CVE-2026-12946
Summary: IBM Langflow OSS 1.0.0–1.10.0 is affected by a vulnerability in the CUGA Component CodeAgent that permits remote code execution through improper control of user input code. The issue resides in CodeAgent’s Python code execution path, enabling an attacker (authenticated) to run arbitrary ...
CVE-2026-12946 Remote Code Execution in CUGA Component CodeAgent
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code...
ariadne-sensemaking (>=0.1.0, <=0.1.2), atlan-mcp-server (0.3.1) +5 more potentially affected by CVE-2025-64340 via fastmcp (2.13.2)
fastmcp PYPI version 2.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - ariadne-sensemaking =0.1.0, =1.0.35, =0.5.33, =0.5.34 Source cves: CVE-2025-64340 Source advisory: OSV:PYSEC-2026-2475...
cuga (0.1.0), minitap-mobile-use (>=0.0.1.dev0, <=2.1.0) +3 more potentially affected by CVE-2026-26013 via langchain-core (0.3.66)
langchain-core PYPI version 0.3.66 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - cuga 0.1.0 - minitap-mobile-use =0.0.1.dev0, =0.2.0, =0.1.0, =0.0.11, =0.0.61 Source cves: CVE-2026-26013 Source advisory:...
ariadne-sensemaking (>=0.1.0, <=0.1.2), atlan-mcp-server (0.3.1) +5 more potentially affected by CVE-2026-32871 via fastmcp (2.13.2)
fastmcp PYPI version 2.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - ariadne-sensemaking =0.1.0, =1.0.35, =0.5.33, =0.5.34 Source cves: CVE-2026-32871 Source advisory: OSV:GHSA-VV7Q-7JX5-F767...
ariadne-sensemaking (>=0.1.0, <=0.1.2), atlan-mcp-server (0.3.1) +5 more potentially affected by CVE-2025-64340 via fastmcp (2.13.2)
fastmcp PYPI version 2.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - ariadne-sensemaking =0.1.0, =1.0.35, =0.5.33, =0.5.34 Source cves: CVE-2025-64340 Source advisory: OSV:GHSA-M8X7-R2RG-VH5G...
cuga (0.1.0), minitap-mobile-use (>=0.0.1.dev0, <=2.1.0) +3 more potentially affected by CVE-2026-34070 via langchain-core (0.3.66)
langchain-core PYPI version 0.3.66 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - cuga 0.1.0 - minitap-mobile-use =0.0.1.dev0, =0.2.0, =0.1.0, =0.0.11, =0.0.61 Source cves: CVE-2026-34070 Source advisory:...
cuga (0.1.0), minitap-mobile-use (>=0.0.1.dev0, <=2.1.0) +3 more potentially affected by CVE-2026-34070 via langchain-core (0.3.66)
langchain-core PYPI version 0.3.66 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - cuga 0.1.0 - minitap-mobile-use =0.0.1.dev0, =0.2.0, =0.1.0, =0.0.11, =0.0.61 Source cves: CVE-2026-34070 Source advisory:...
cuga (0.1.0), katalyst (0.9.1) +1 more potentially affected by CVE-2026-28277 via langgraph (0.5.3)
langgraph PYPI version 0.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - cuga 0.1.0 - katalyst 0.9.1 - meez =0.2.11, =0.2.14 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...
cuga (0.1.0), katalyst (0.9.1) +1 more potentially affected by CVE-2026-28277 via langgraph (0.5.3)
langgraph PYPI version 0.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - cuga 0.1.0 - katalyst 0.9.1 - meez =0.2.11, =0.2.14 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...
cuga (0.1.0), minitap-mobile-use (>=0.0.1.dev0, <=2.1.0) +3 more potentially affected by CVE-2026-26013 via langchain-core (0.3.66)
langchain-core PYPI version 0.3.66 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - cuga 0.1.0 - minitap-mobile-use =0.0.1.dev0, =0.2.0, =0.1.0, =0.0.11, =0.0.61 Source cves: CVE-2026-26013 Source advisory:...
