2174 matches found
IBM Langflow OSS Code Execution Vulnerability (CNVD-2026-32373)
IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a code execution vulnerability. This vulnerability stems from improper handling of HTTP requests, allowing attackers to execute arbitrary code on the server by exploiting this...
IBM Langflow OSS path traversal vulnerability
IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a path traversal vulnerability. This vulnerability arises from the use of user-provided knowledge base names directly for creating file paths. Without proper cleaning or check...
IBM Langflow OSS Authentication Bypass Vulnerability
IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a vulnerability related to authentication bypass. This vulnerability arises when the MCP Composer endpoint is set to mcpcomposerEnabled=true default value and the project...
IBM Langflow OSS Code Execution Vulnerability
IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a code execution vulnerability. This vulnerability stems from the use of truncated SHA-256 hashes for code verification by the custom component validation mechanism. The hashi...
IBM Langflow OSS authorization bypass vulnerability
IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a vulnerability related to authorization bypass. This vulnerability arises from the fact that the retrievemessages and storemessage methods of MemoryComponent only filter...
IBM Langflow OSS weak encryption key derivation vulnerability
IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a weak encryption key derivation vulnerability. This vulnerability stems from the ensurefernetkey function not properly handling the key derivation process, resulting in...
IBM Langflow OSS Code Execution Vulnerability (CNVD-2026-32369)
IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a code execution vulnerability. This vulnerability stems from the failure to properly handle components generated by the LLM during the Agentic Assistant validation process. T...
IBM Langflow OSS code injection vulnerability
IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a code injection vulnerability. This vulnerability arises from improper handling of user input code, resulting in inadequate control over inputs. Attackers can exploit this...
GHSA-9PW3-X84F-XCWF Duplicate Advisory: Langflow: Weak Fernet Key via random.seed()
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jxw3-mjmx-3pqm. This link is maintained to preserve external references. Original Description IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...
Duplicate Advisory: Langflow: Weak Fernet Key via random.seed()
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jxw3-mjmx-3pqm. This link is maintained to preserve external references. Original Description IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...
CVE-2026-9205
IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...
CVE-2026-9205
IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...
CVE-2026-9196
IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user...
CVE-2026-9201
IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component validation mechanism. When the optional hardening mode that restricts execution to trusted component templates is enabled, the application...
CVE-2026-9201
IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component validation mechanism. When the optional hardening mode that restricts execution to trusted component templates is enabled, the application...
CVE-2026-9196
IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user...
CVE-2026-9130
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...
CVE-2026-9130
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...