Security Bulletin: Server-Side Request Forgery (SSRF) in Langflow URL Component

Summary IBM Langflow Desktop contains a Server-Side Request Forgery SSRF vulnerability in the URL data source component where user-supplied URLs are insufficiently validated before being used in backend HTTP requests, allowing authenticated attackers to force the Langflow server to make arbitrary...

CVE-2024-14032

creationtimestamp| type| source ---|---|--- 2026-04-06 18:52:21+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mitwpdda7s2z 2026-04-14 03:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mjgfmj3sxd2v...

CVE-2026-39376

creationtimestamp| type| source ---|---|--- 2026-04-06 15:20:43+00:00| published-proof-of-concept| https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37 2026-04-07 21:22:30+00:00| published-proof-of-concept| Telegram/PsCoAl2rNCHfpa-IE94yjZNK4tjM6zifbqO0UkQOdEj8yI...

CVE-2025-14463

creationtimestamp| type| source ---|---|--- 2026-01-17 07:23:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcm3fa6ajt2x...

CVE-2025-65276

creationtimestamp| type| source ---|---|--- 2025-11-26 23:05:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6kxrbdkvn2q...

CVE-2022-0288

creationtimestamp| type| source ---|---|--- 2025-02-19 21:02:34+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3likodqig732b...

CVE-2020-0878

creationtimestamp| type| source ---|---|--- 2021-11-08 08:58:18+00:00| seen| MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422 2021-11-20 09:53:52+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-12-24 20:23:29+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971045 2025-02-23...

CVE-2021-3198 and CVE-2021-3540: MobileIron Shell Escape Privilege Escalation Vulnerabilities

Ivanti MobileIron Core versions 10.7.0.1-9 and 11.0.0.1-3 suffer from two restricted shell escape vulnerabilities through the install rpm command present in the clish restricted shell. These issues have been fixed in version 11.1.0.0, released on March 15, 2021. The first, CVE-2021-3198, is an...

Microsoft Internet Explorer execCommand method does not properly validate URL source

Overview Microsoft Internet Explorer IE does not properly determine the source of script used in URLs. An attacker could exploit this vulnerability to evaluate script in different security domains. By causing script to be evaluated in the Local Machine Zone, the attacker could execute arbitrary...

Microsoft Internet Explorer does not properly validate URL sources

Overview Microsoft Internet Explorer IE does not properly determine the source of script used in URLs. An attacker could exploit this vulnerability to evaluate script in different security domains. By causing script to be evaluated in the Local Machine Zone, the attacker could execute arbitrary...