4 CVEs publicados el 2026-10-30 · 1 con prueba de concepto pública · CVSS máximo 9.9/10.
Productos afectados (catálogo NVD)
langflow/langflow
CVEs de este lote
| CVE | Severidad | CVSS | EPSS | Estado | Descripción |
|---|---|---|---|---|---|
| CVE-2026-107328 | CRITICAL | 9.9 | 0.8% | PoC | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec. |
| CVE-2026-103092 | HIGH | 8.5 | 0.4% | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control. | |
| CVE-2026-18894 | MEDIUM | 6.5 | 0.4% | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context… | |
| CVE-2026-102590 | MEDIUM | 5.0 | 0.2% | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability. |