CVE-2026-88962

IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by CVE-2026-88962 , which allows a remote authenticated attacker to execute arbitrary code. The root cause is identified as CWE-94: Improper Control of Generation of Code ('Code Injection') . Successful exploitation could lead to high-im...

CVE-2026-93443

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to a flaw involving the improper neutralization of special elements used in code. This vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution . While no specific exploit links or scanner source co...

CVE-2026-93448

IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by a vulnerability that allows a remote authenticated attacker to obtain sensitive information . This is caused by an improper limitation of a pathname to a restricted directory (CWE-22). No specific remediation or exploit details are pr...

CVE-2026-93449

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to arbitrary code execution . The flaw stems from improper control of code generation , which could be exploited by a remote authenticated attacker . The severity is rated as High (CVSS 3.1: 8.5). No specific exploit details or remedia...

CVE-2026-93445

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to arbitrary code execution. A remote authenticated attacker can exploit the software due to improper control of generation of code (CWE-94). The vulnerability carries a CVSS 3.1 base score of 8.1 (High) , with impacts on confidentiali...

CVE-2026-93447

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to a deserialization of untrusted data flaw (CWE-502). An attacker who possesses the server secret and has Redis write access can submit a malicious serialized cache value. Upon retrieval, the system may execute attacker-controlled cod...

CVE-2026-93675

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to an arbitrary code execution flaw. The root cause is identified as an expected dependency confusion vulnerability. A remote attacker could exploit this issue to execute code on the target system. No specific exploits or scanner sourc...

CVE-2026-93677

IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by a vulnerability that could allow a remote authenticated attacker to obtain sensitive information . This is caused by the exposure of sensitive information to an unauthorized actor, classified under CWE-200 . The vulnerability has a CV...

CVE-2026-93678

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to a security flaw caused by improper authorization . A remote authenticated attacker could exploit this weakness to obtain sensitive information . The vulnerability is associated with CWE-639 (Authorization Bypass Through User-Control...

CVE-2026-93679

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to a denial of service (DoS) attack. The root cause is uncontrolled resource consumption occurring during the extraction of ZIP files . A remote authenticated attacker could exploit this to exhaust system resources. No specific exploit...

CVE-2026-93674

Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to a critical remote code execution (RCE) flaw (CVE-2026-93674 ). The root cause is the improper neutralization of special elements used in an OS command (CWE-94), which allows a remote attacker to execute arbitrary code. This vulnerabilit...

CVE-2026-97671

IBM Langflow OSS versions 1.0.0 through 1.12.2 are susceptible to a path traversal vulnerability (CWE-22 ). This flaw could allow a remote authenticated attacker to obtain sensitive information . No specific exploit details, impacts beyond information disclosure, or remediation steps are provided...

CVE-2026-97673

The Langflow OSS software versions 1.0.0 through 1.12.2 are affected by CVE-2026-97673 , which allows a remote authenticated attacker to execute arbitrary code due to improper input validation (CWE-693 ). This vulnerability can lead to high impact on confidentiality, integrity, and availability. ...

CVE-2026-97674

IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by a Code Injection vulnerability (CVE-2026-97674 ). Due to the improper neutralization of special elements used in an OS command, a remote authenticated attacker could execute arbitrary OS commands. This flaw is categorized under CWE-94...

CVE-2026-97678

IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by CVE-2026-97678 , which allows a remote authenticated attacker to execute arbitrary code due to improper input validation (CWE-693). The vulnerability has a HIGH base severity score of 8.8 . To remediate this issue, IBM strongly recomm...

CVE-2026-97679

IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by a Code Injection vulnerability (CVE-2026-97679 ). A remote authenticated attacker can execute arbitrary code due to the improper neutralization of special elements used in an OS command, which stems from improper input validation . Th...

CVE-2026-97680

IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by a vulnerability (CVE-2026-97680 ) caused by improper access control in the vertex result caching subsystem . This flaw could allow a remote authenticated attacker to obtain sensitive information or inject malicious data . To remediate...

CVE-2026-97655

Langflow OSS versions 1.0.0 through 1.12.2 are affected by CVE-2026-97655 , which allows a remote attacker to execute arbitrary code. The root cause is an incomplete blocklist within the code security scanner, classified as CWE-94: Improper Control of Generation of Code ('Code Injection') . This ...

CVE-2026-97676

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to a code injection flaw (CWE-94 ). A remote authenticated attacker can exploit the improper neutralization of special elements used in code to achieve a sandbox escape and execute arbitrary code. The severity is rated as High with a C...

CVE-2026-101329

IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by an improper access control vulnerability (CWE-284). This flaw could allow a remote authenticated attacker to obtain sensitive information . IBM strongly recommends upgrading to version 1.12.3 to remediate the issue. No specific exploi...