CVE-2026-0770

CVE-2026-0770: Langflow execglobals Unauthenticated Remote Code Execution PoC CVE-2026-0770 an unauthenticated Remote Code Execution RCE vulnerability affecting Langflow. The flaw stems from improper input validation within the handling of the execglobals parameter provided to the /validate...

CVE-2025-3248

CVE-2025-3248 Langflow is a low-code platform primarily used for building and deploying AI agents and workflows. It simplifies the development process by providing a visual interface for creating complex AI applications, including chatbots, RAG Retrieval-Augmented Generation systems, and more...

CVE-2025-3248

CVE-2025-3248 Introduction Langflow versions prior to 1.3.0 are susceptible to unauthenticated code injection in the /api/v1/validate/code endpoint via Python exec function. This exploit establishes a reverse shell connection abusing this vulnerability. Usage Configuration git clone...

CVE-2025-3248-POC

Langflow RCE Exploit - CVE-2025-3248 ⚠️ Disclaimer This code is strictly intended for educational and research purposes only. Unauthorized use on systems without explicit permission may constitute a violation of the law. The author is not responsible for any misuse or malicious activity involving...

PT-2026-132854

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a document exceeds max errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validati...

CVE-2026-119286: graphql-python graphql-core: GraphQL-core is a Python port of the GraphQL.js reference implementation

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a document exceeds maxerrors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validatio...

CVE-2026-0770

CVE-2026-0770 Overview This tool is used to test the vulnerability CVE-2026-0770 in the Langflow application. It leverages the /api/v1/validate/code endpoint to perform Remote Code Execution RCE. Developer: Ohang Thanks to: @C4p333 Purpose: Security Research & Educational Use Installation Termux...

CVE-2026-99112

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflower: validate mask pointer after nlanext flsetencopt iterates the key's nested tunnel-option attributes with nlaforeachattr while advancing a single mask pointer via nlanext at the bottom of each loop, so the mas...

CVE-2026-116593

Apache Kafka Connect has the /connector-plugins/connector-type/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. An...

EUVD-2026-112174

Apache Kafka Connect has the /connector-plugins/connector-type/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. An...

CVE-2026-116593 Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint

Apache Kafka Connect has the /connector-plugins/connector-type/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. An...

CVE-2026-116593

Apache Kafka Connect is vulnerable to the exposure of sensitive configuration values. The issue resides in the REST API endpoint /connector-plugins/{connector-type}/config/validate, which is used to validate connector configurations. While Configuration Providers are designed to hide sensitive va...

Langflow-CVE-2025-3248-Multi-target

⚠️ Langflow RCE Exploit Scanner CVE-2025-3248 This Python-based scanner automates the detection of unauthenticated Remote Code Execution RCE vulnerabilities in Langflow instances via CVE-2025-3248. It uses a proof-of-concept payload that abuses the /api/v1/validate/code endpoint to execute...

PT-2026-128299

Apache Kafka Connect has the /connector-plugins/connector-type/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. An...

PT-2026-128119

In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Prevent XID null dereference The mpc validate xid function sets grp-saved xid2-xid2 flag2 to 0x40 to signal XID validation error. If peer XID is NULL or r/w channel pairing mismatch happens, grp-saved xid2 is never...

EUVD-2026-107580

Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its...

CVE-2026-112921

Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its...

CVE-2026-112921 Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request

Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its...

CVE-2026-112921

The Robots::Validate Perl module (versions 0.4.3 through 0.4.10) is vulnerable to a state-carryover issue in its Aho-Corasick search machine . Because the machine's state is not reset between requests, a User-Agent ending mid-match can cause a subsequent request to complete that match. This allow...

CVE-2026-112921

Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its...