Total
210 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-93680 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 9.8 CRITICAL |
| IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication. | |||||
| CVE-2026-110196 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 8.8 HIGH |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs. | |||||
| CVE-2026-110186 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 9.8 CRITICAL |
| IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | |||||
| CVE-2026-107329 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 9.9 CRITICAL |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. | |||||
| CVE-2026-107327 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 9.9 CRITICAL |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization. | |||||
| CVE-2026-107326 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 8.8 HIGH |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | |||||
| CVE-2026-104324 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 8.8 HIGH |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data. | |||||
| CVE-2026-104317 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 8.1 HIGH |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data. | |||||
| CVE-2026-101288 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 8.8 HIGH |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code. | |||||
| CVE-2026-102590 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 5.0 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability. | |||||
| CVE-2026-103092 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 8.5 HIGH |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control. | |||||
| CVE-2026-104308 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 4.3 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command. | |||||
| CVE-2026-104309 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 6.5 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | |||||
| CVE-2026-104310 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 4.3 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability. | |||||
| CVE-2026-104312 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 3.5 LOW |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim using a non-sanitizing tool could result in arbitrary file write on the victim's host. | |||||
| CVE-2026-104314 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 6.5 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with a read or share grant on a target flow to retrieve the flow owner's stored third-party credentials in cleartext from the API response. | |||||
| CVE-2026-104315 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 4.3 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | |||||
| CVE-2026-104316 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 6.5 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request, resulting in loss of in-progress compute work with no flow-level permission check. | |||||
| CVE-2026-104328 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 8.8 HIGH |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | |||||
| CVE-2026-104331 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 5.4 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | |||||