Filtered by vendor Ibm
Subscriptions
Filtered by product Langflow Oss
Subscriptions
Total
176 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110190 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system. | ||||
| CVE-2026-110192 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials. | ||||
| CVE-2026-110193 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server. | ||||
| CVE-2026-110196 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs. | ||||
| CVE-2026-110200 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information. | ||||
| CVE-2026-110244 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | ||||
| CVE-2026-110245 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 7.5 High |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication. | ||||
| CVE-2026-110309 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation. | ||||
| CVE-2026-18894 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code. | ||||
| CVE-2026-77817 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports. | ||||
| CVE-2026-77819 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory. | ||||
| CVE-2026-90991 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling. | ||||
| CVE-2026-93680 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 9.8 Critical |
| IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication. | ||||
| CVE-2026-107366 | 1 Ibm | 1 Langflow Oss | 2026-10-20 | 8.3 High |
| IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID. | ||||
| CVE-2026-104335 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-09 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control. | ||||
| CVE-2026-93678 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-09 | 7.6 High |
| IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. | ||||
| CVE-2026-93448 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-09 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | ||||
| CVE-2026-93674 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-08 | 9.8 Critical |
| IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | ||||
| CVE-2026-93443 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-08 | 7.5 High |
| IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code. | ||||
| CVE-2026-104334 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-08 | 9.8 Critical |
| IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | ||||