CVE Vulnerability Catalog

IBM Langflow OSS versions 1.0.0 through 1.10.3 allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM-generated components. The application executes model-generated Python code in the backend before user approval, which may lead to side effects such as network access, file system interaction, or data exfiltration.

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The retrieve_messages and store_message methods filter only on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple API endpoints.

IBM Langflow OSS versions 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system due to improper control of user input code.

IBM Langflow OSS versions 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

IBM Langflow OSS versions 1.0.0 through 1.10.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing 'dot dot' sequences ( /../ ) to view arbitrary files on the system.

IBM Langflow OSS installations versions 1.0.0 through 1.10.3 allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP requests.

A local privilege escalation vulnerability has been discovered in the NI-PAL kernel driver. It may allow a local, authenticated user to escalate privileges and execute arbitrary code. This vulnerability affects NI-PAL 26.3.1 and prior versions running on Microsoft Windows.

IBM Langflow OSS versions 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection.

IBM Langflow OSS versions 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning.

IBM Langflow OSS versions 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of module imports.

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a Server-Side Request Forgery (SSRF) vulnerability in the validate_model_provider_key() function for the Ollama provider. The function accepts a user-supplied OLLAMA_BASE_URL parameter and passes it directly to requests.get() without validation, scheme/host allowlisting, or filtering of private IP ranges.

Electron before versions 39.8.10, 41.10.3, and 42.0.1 allowed a sandboxed iframe without the allow-popups keyword to open new windows or trigger setWindowOpenHandler without user interaction. This occurs because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups are affected, while apps that deny window creation in setWindowOpenHandler or do not embed untrusted content are not.

Jenkins Ivy Report Plugin version 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Ivy report files.

A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM.

Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

IBM Langflow OSS versions 1.0.0 through 1.10.3 (repeated) could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields[].type value starts with 'geometry' but contains attacker-controlled SQL syntax after the geometry subtype. This issue affects Directus before 12.1.0.

IBM Langflow OSS 1.0.0 through 1.10.3 allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system.

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are configured with auth_type=oauth.

As part of an internal security review in Cisco Catalyst SD-WAN, multiple vulnerabilities related to improper link resolution before file access (CWE-1284) were discovered. Hardened software releases addressing these issues have been issued.