CVE-2026-10560 Unauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSS

IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buildpublictmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service...

CVE-2026-7663

Langflow OSS 1.0.0–1.9.6 is affected by an improper authorization vulnerability in the Streamable MCP transport endpoint (/api/v1/mcp/project/{project_id}/streamable) that allows unauthenticated attackers to access protected MCP resources and perform MCP operations. IBM bulletin cites cross‑user ...

EUVD-2026-40380

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanism for encryption at rest...

GHSA-H8VQ-8GPG-MHCG Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

Description This is a residual bypass of CVE-2026-46635 / GHSA-vcc8-phrv-43wj that only affects sandboxing enabled through SourcePolicyInterface and not the regular global sandbox mode. CoreExtension::column receives the active sandbox state via the needsissandboxed channel as a boolean...

CVE-2026-58376

creationtimestamp| type| source ---|---|--- 2026-06-30 18:30:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjn5cyb4w2m 2026-07-03 10:06:32+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpqce4xggx2r 2026-07-03 10:06:33+00:00| seen|...

CVE-2026-58372

creationtimestamp| type| source ---|---|--- 2026-06-30 18:25:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjmudi45y2u 2026-07-02 05:56:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpndwv4afe2t...

EUVD-2026-36099

Fission Container Executor Function PodSpec Injection Leading to Node Escape...

CVE-2026-10655

creationtimestamp| type| source ---|---|--- 2026-06-30 18:17:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjmfwxtzh2v...

CVE-2026-12560

creationtimestamp| type| source ---|---|--- 2026-06-30 18:17:11+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpjmeqasoq2c...

EUVD-2026-36096

Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook...

Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook

Summary A Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; PackageRef.Namespace was not. Details A tenant with functions.fission.io/create in their own namespace could set...

CVE-2026-58371

creationtimestamp| type| source ---|---|--- 2026-06-30 18:14:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjm7xuynj24 2026-07-02 05:52:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpndoycmhy2i...

CVE-2026-8864

creationtimestamp| type| source ---|---|--- 2026-06-30 18:11:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjm2lvbnn2u...

CVE-2026-10654

creationtimestamp| type| source ---|---|--- 2026-06-30 18:08:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjlvpiomc2p...

CVE-2026-58369

creationtimestamp| type| source ---|---|--- 2026-06-30 18:06:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjlra3qxv2d 2026-07-02 05:55:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpndu7ch5u2t...

CVE-2026-58174

creationtimestamp| type| source ---|---|--- 2026-06-30 18:03:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjln3piyx2z 2026-07-02 06:06:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnei2e2a52k...

CVE-2026-10653

creationtimestamp| type| source ---|---|--- 2026-06-30 18:01:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjljaqkzx2z...

CVE-2026-58377

creationtimestamp| type| source ---|---|--- 2026-06-30 17:59:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjlfnxyxp2d 2026-07-02 05:59:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpne2y63yj22...

CVE-2026-58176

creationtimestamp| type| source ---|---|--- 2026-06-30 17:57:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjlccebvu23...

CVE-2026-58171

creationtimestamp| type| source ---|---|--- 2026-06-30 17:52:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjkzcp3tf2u 2026-07-02 05:55:05+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpndtlgxfx26...