CVE-2025-3248-Langflow-RCE

CVE-2025-3248 — Langflow Unauthenticated Remote Code Execution Proof-of-Concept exploit for CVE-2025-3248 , an unauthenticated remote code execution vulnerability in Langflow, an AI/LLM workflow-building platform. Affected versions: Langflow 1.3.0 Fixed in: 1.3.0 Vulnerability class:...

CVE-2026-9198

CVE-2026-9198 Vulnerability cause: IBM Langflow OSS is an open-source software specifically used for building and deploying Agent automation workflows. IBM Langflow OSS from 1.0.0 to 1.10.0 has automatic login enabled by default autologin is true. In this mode, accessing the /api/v1/autologin...

exposecheck

EXPOSECHECK Only run against servers you own or are authorized to test. Scope: a passing result means only that this narrow check found an authentication challenge and a Langflow version at or above the patched threshold for CVE-2025-3248. It is not a general security, reputation, configuration, ...

CVE-2026-11547

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by a server-side request forgery vulnerability in the Admin Center deploy validation endpoint...

CVE-2026-11547

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected by a server-side request forgery (SSRF) vulnerability in the Admin Center deploy validation endpoint. This vulnerability, tracked as CVE-2026-11547 , allows an attacker to potentially conduct requests from t...

CVE-2026-11547 IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by a server-side request forgery vulnerability in the Admin Center deploy validation endpoint...

EUVD-2026-119687

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by a server-side request forgery vulnerability in the Admin Center deploy validation endpoint...

IBM WebSphere Application Server - Liberty server-side request forgery vulnerability

IBM WebSphere Application Server – Versions 17.0.0.3 through 26.0.0.10 contain a server-side request forgery vulnerability. This vulnerability stems from issues related to the validation endpoint in Admin Center, potentially allowing attackers to forge server-side requests...

PT-2026-140039

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by a server-side request forgery vulnerability in the Admin Center deploy validation endpoint...

Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-10844 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to conduct phishing attacks. CWE:CWE-601: URL Redirection to...

Langflow: Code Injection Vulnerability In Code Validation Endpoint

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement...

9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

The Kiro API-key validation endpoint builds an upstream URL using a user-controlled region value. By supplying a crafted region such as kiro-canary.local:8443, an authenticated attacker can cause 9router to send the Kiro validation request to an attacker-controlled host under the constructed...

CLEANSTART-2026-RG79000 Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period

Security vulnerability affects the vault package. Vault and Vault Enterprise’s “Vault” TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period...

CVE-2026-81905

Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...

CVE-2026-77771: Improper Authentication

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

CSRF vulnerability in jenkins-multijob-plugin allows arbitrary code execution

jenkins-multijob-plugin 669.v9d96ad9c71b0 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to execute arbitrary code in the context of the Jenkins controller JVM...

CVE-2026-63238 Authentication bypass vulnerability

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...

CVE-2026-63238: Improper Authentication

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...

CVE-2026-8481

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec function without sandboxing, input...

CVE-2026-8481 Remote Code Execution via Code Validation Endpoint

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec function without sandboxing, input...