{"schema_version":"2","view":"grouped","data":[{"id":3300,"cve_ids":["CVE-2026-19304"],"payload":{"kind":"advisory","title":"Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components","summary":"IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.","evidence":"cve:CVE-2026-19304","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-19304","aliases":["CVE-2026-19304"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.11.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.11.2"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T19:07:57.581Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7285639"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19304","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-08T17:14:42.581676Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-08T17:14:54.503Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-09-28T19:07:57.581Z"}}},"related_cves":[{"value":"CVE-2026-19304","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3c961973-8b01-4e1b-b5c4-410533a668a2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19304","advisory_id":"3c961973-8b01-4e1b-b5c4-410533a668a2","event_types":["advisory"],"published_at":"2026-10-24T21:33:27.9217+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T15:30:25.425+00:00","detail_url":"/advisories/advisory%3A3c961973-8b01-4e1b-b5c4-410533a668a2","group":{"id":"advisory:3c961973-8b01-4e1b-b5c4-410533a668a2","revision":1,"primary_event_id":3313,"change":"published","superseded_by":[],"changed":{"id":3313,"cve_ids":["CVE-2026-19304"],"payload":{"kind":"advisory","title":"Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components","summary":"IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.","evidence":"cve:CVE-2026-19304","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-19304","aliases":["CVE-2026-19304"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.11.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.11.2"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T19:07:57.581Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7285639"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19304","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-08T17:14:42.581676Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-08T17:14:54.503Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-09-28T19:07:57.581Z"}}},"related_cves":[{"value":"CVE-2026-19304","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3c961973-8b01-4e1b-b5c4-410533a668a2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19304","advisory_id":"3c961973-8b01-4e1b-b5c4-410533a668a2","event_types":["advisory"],"published_at":"2026-10-24T21:33:27.9217+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T15:30:25.425+00:00","detail_url":"/events/3313"},"members":[{"id":3313,"cve_ids":["CVE-2026-19304"],"payload":{"kind":"advisory","title":"Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components","summary":"IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.","evidence":"cve:CVE-2026-19304","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-19304","aliases":["CVE-2026-19304"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.11.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.11.2"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T19:07:57.581Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7285639"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19304","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-08T17:14:42.581676Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-08T17:14:54.503Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-09-28T19:07:57.581Z"}}},"related_cves":[{"value":"CVE-2026-19304","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3c961973-8b01-4e1b-b5c4-410533a668a2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19304","advisory_id":"3c961973-8b01-4e1b-b5c4-410533a668a2","event_types":["advisory"],"published_at":"2026-10-24T21:33:27.9217+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T15:30:25.425+00:00","detail_url":"/events/3313"}]}}],"next_after":3300,"next_before":3300}