CVE-2023-38646

CVE-2023-38646 Metabase RCE sans authentification 26/11/2023 Metabase open source avant 0.46.6.1 et Metabase Enterprise avant 1.46.6.1 permettent aux attaquants d'exécuter des commandes arbitraires sur le serveur, au niveau de privilège du serveur. L'authentification n'est pas requise pour...

CVE-2026-0770

CVE-2026-0770 : Langflow execglobals Exécution de code à distance non authentifiée PoC CVE-2026-0770 est une vulnérabilité d'exécution de code à distance RCE non authentifiée affectant Langflow. La faille provient d'une validation d'entrée incorrecte dans la gestion du paramètre execglobals fourn...

metabase-cve-2023-38646

cd /metabase-poc cat README.md 'EOF' CVE-2023-38646 — Exécution de code à distance sans authentification sur Metabase Résumé Score CVSS 9.8. Les versions de Metabase antérieures à 0.46.6.1 / 1.46.6.1 ainsi que les branches antérieures équivalentes exposent une RCE sans authentification via le poi...

cve-2026-0770-langflow_rce_reproduction

CVE-2026-0770: Langflow execglobals - Exécution de code à distance CVSS 9.8 Critique | ZDI-CAN-27325 | CWE-829 : Inclusion de fonctionnalités provenant d'une source non fiable Vue d'ensemble CVE-2026-0770 est une vulnérabilité critique d'exécution de code à distance non authentifiée dans Langflow...

VulnCheck KEV: CVE-2026-0768

Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code...

Exploit for Code Injection in Langflow

CVE-2025-3248 — Langflow Unauthenticated Remote Code Execution...

Exploit for Inclusion of Functionality from Untrusted Control Sphere in Langflow

CVE-2026-0770: Langflow execglobals Remote Code Execution...

CVE-2026-8481

Langflow OSS versions 1.0.0–1.10.0 are affected by a remote code execution vulnerability in the code validation endpoint. The POST /api/v1/validate/code endpoint executes user-supplied Python code via Python’s built-in exec() without sandboxing or input validation, allowing any authenticated user...

Langflow affected by Remote Code Execution via validate_code() exec()

Langflow execglobals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.The specific...

GHSA-3FWP-P5RJ-2PXF Gitea: Missing repository-unit authorization on issue-template API endpoints

Summary Three Gitea API endpoints — GET /repos/owner/repo/issuetemplates, GET /repos/owner/repo/issueconfig and GET /repos/owner/repo/issueconfig/validate — read files from the repository's Code default branch .gitea/ISSUETEMPLATE/ and issueconfig.yaml and return their contents, but are registere...

Langflow 1.3.0 - Remote Code Execution

Exploit Title: Langflow 1.3.0 - Remote Code Execution Fofa-dork: title="Langflow" Shodan-dork: title:"Langflow" Date: 23-05-2026 Exploit Author: Diamorphine Venodor Homepage: https://www.langflow.org/ Software Link: https://github.com/langflow-ai/langflow Version: 1.2.0 Tested on: Debian CVE :...

📄 Langflow 1.3.0 Remote Code Execution

Langflow contains a remote code execution caused by inclusion of functionality from untrusted control sphere in the execglobals parameter at the validate endpoint, letting remote attackers execute arbitrary code as root, exploit requires no authentication. Exploit Title: Langflow 1.3.0 - Remote...

eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check

Impact If the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. Patches This, along with other issues, was fixed in eduMFA v2.9.1. Workarounds Limiting access to /validate/check to client applications i.e. Shibboleth/FreeRADI...

CVE-2026-7466 AgentFlow Arbitrary Python Pipeline Execution via pipeline_path

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipelinepath parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers can induce requests to the local AgentFlow API to...

CVE-2026-7466 AgentFlow Arbitrary Python Pipeline Execution via pipeline_path

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipelinepath parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers can induce requests to the local AgentFlow API to...

PT-2026-35976

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipeline path parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers can induce requests to the local AgentFlow API to...

EUVD-2026-26080

NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl SSRF protection component, where an attacker could cause a server-side request forgery by supplying a crafted endpoint URL referencing the 0.0.0.0/8 address range through a blueprint configuration file or CLI flag. A successful...

VulnCheck KEV: CVE-2026-0770

Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations...

EUVD-2026-4687

A vulnerability was found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function portValidate of the file /fort/ipandport/portvalidate of the component HTTP POST Request Handler. Performing a manipulation of the argument port results in command...

CVE-2026-0770

Langflow execglobals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific...