CVE-2026-17631 Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery SSRF vulnerability...

EUVD-2026-71462

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery SSRF vulnerability...

CVE-2026-17631

Langflow OSS 1.0.0–1.10.2 is vulnerable to a non-blind server-side request forgery (SSRF) (CWE-918) caused by missing URL validation in flow components for LM Studio, Home Assistant, DeepSeek, xAI, Glean, HuggingFace Inference API, Ollama, LiteLLM, and Docling Serve. An authenticated attacker can...

CVE-2026-82911

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2026-19305

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery...

CVE-2026-19301

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery...

EUVD-2026-71597

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery...

CVE-2026-18905 IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation

IBM ContextForge MCP Gateway mcp-contextforge-gateway = v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation...

CVE-2026-82911 CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2026-82911 CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

EUVD-2026-71268

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2026-82911 CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2026-19304 Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy...

CVE-2026-19305

IBM Langflow OSS versions 1.0.0 through 1.11.2 are vulnerable to Server-Side Request Forgery (SSRF) (CWE-918) in multiple components where a remote attacker with no prior authentication can supply attacker-controlled URLs that reach internal network hosts without adequate validation. Affected com...

CVE-2026-85699

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the...

CVE-2026-85692

Nightingale n9e, as of commit 8362cbe main branch, confirmed 2026-08-27, contains a server-side request forgery vulnerability in the isPublicIP function in aiagent/tools/http.go, the SSRF guard for the httpfetch AI-agent tool. The function only unwraps standard IPv4-mapped ::ffff:a.b.c.d IPv6...

CVE-2026-85695

FastChat contains an authentication bypass vulnerability in the /registerworker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompt...

CVE-2026-85667

xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhookworktool handler and exploit unvalidated media UR...

CVE-2026-85662

Marqo 2.26.0 contains a server-side request forgery vulnerability in the adddocuments endpoint that allows unauthenticated attackers to trigger requests to arbitrary URLs by supplying malicious media field values. Attackers can exploit downloadimagefromurl and fetchcontentsample functions which...

CVE-2026-85608

DouyinTikTokDownloadAPI through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/videodata endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services including...