{"schema_version":"2","view":"grouped","data":[{"id":45487,"cve_ids":["CVE-2026-107366"],"payload":{"kind":"advisory","title":"Langflow OSS Authorization Bypass Through User-Controlled Key","summary":"IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.","evidence":"cve:CVE-2026-107366","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-107366","aliases":["CVE-2026-107366"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.4"}]}],"modified":"2026-10-21T03:56:18.876Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7293016"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-107366","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-20T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T03:56:18.876Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-19T23:49:23.120Z"}}},"related_cves":[{"value":"CVE-2026-107366","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:70056b85-bbf8-482c-bf13-b09185678c03","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107366","advisory_id":"70056b85-bbf8-482c-bf13-b09185678c03","event_types":["advisory"],"published_at":"2026-10-25T12:27:20.525354+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-19T23:49:23.12+00:00","detail_url":"/advisories/advisory%3A70056b85-bbf8-482c-bf13-b09185678c03","group":{"id":"advisory:70056b85-bbf8-482c-bf13-b09185678c03","revision":1,"primary_event_id":45052,"change":"published","superseded_by":[],"changed":{"id":45052,"cve_ids":["CVE-2026-107366"],"payload":{"kind":"advisory","title":"Langflow OSS Authorization Bypass Through User-Controlled Key","summary":"IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.","evidence":"cve:CVE-2026-107366","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-107366","aliases":["CVE-2026-107366"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.4"}]}],"modified":"2026-10-21T03:56:18.876Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7293016"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-107366","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-20T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T03:56:18.876Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-19T23:49:23.120Z"}}},"related_cves":[{"value":"CVE-2026-107366","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:70056b85-bbf8-482c-bf13-b09185678c03","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107366","advisory_id":"70056b85-bbf8-482c-bf13-b09185678c03","event_types":["advisory"],"published_at":"2026-10-25T12:27:20.525354+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-19T23:49:23.12+00:00","detail_url":"/events/45052"},"members":[{"id":45052,"cve_ids":["CVE-2026-107366"],"payload":{"kind":"advisory","title":"Langflow OSS Authorization Bypass Through User-Controlled Key","summary":"IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.","evidence":"cve:CVE-2026-107366","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-107366","aliases":["CVE-2026-107366"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.4"}]}],"modified":"2026-10-21T03:56:18.876Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7293016"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-107366","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-20T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T03:56:18.876Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-19T23:49:23.120Z"}}},"related_cves":[{"value":"CVE-2026-107366","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:70056b85-bbf8-482c-bf13-b09185678c03","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107366","advisory_id":"70056b85-bbf8-482c-bf13-b09185678c03","event_types":["advisory"],"published_at":"2026-10-25T12:27:20.525354+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-19T23:49:23.12+00:00","detail_url":"/events/45052"}]}},{"id":16260,"cve_ids":["CVE-2026-93678"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.","evidence":"cve:CVE-2026-93678","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93678","aliases":["CVE-2026-93678"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-09T02:03:23.265Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93678","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-09T02:03:14.982811Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-09T02:03:23.265Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:01:03.609Z"}}},"related_cves":[{"value":"CVE-2026-93678","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:60e7044f-e344-4f58-a4e7-613e5c7d5132","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93678","advisory_id":"60e7044f-e344-4f58-a4e7-613e5c7d5132","event_types":["advisory"],"published_at":"2026-10-25T01:12:21.641335+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:01:03.609+00:00","detail_url":"/advisories/advisory%3A60e7044f-e344-4f58-a4e7-613e5c7d5132","group":{"id":"advisory:60e7044f-e344-4f58-a4e7-613e5c7d5132","revision":1,"primary_event_id":16163,"change":"published","superseded_by":[],"changed":{"id":16163,"cve_ids":["CVE-2026-93678"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.","evidence":"cve:CVE-2026-93678","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93678","aliases":["CVE-2026-93678"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-09T02:03:23.265Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93678","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-09T02:03:14.982811Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-09T02:03:23.265Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:01:03.609Z"}}},"related_cves":[{"value":"CVE-2026-93678","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:60e7044f-e344-4f58-a4e7-613e5c7d5132","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93678","advisory_id":"60e7044f-e344-4f58-a4e7-613e5c7d5132","event_types":["advisory"],"published_at":"2026-10-25T01:12:21.641335+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:01:03.609+00:00","detail_url":"/events/16163"},"members":[{"id":16163,"cve_ids":["CVE-2026-93678"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.","evidence":"cve:CVE-2026-93678","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93678","aliases":["CVE-2026-93678"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-09T02:03:23.265Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93678","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-09T02:03:14.982811Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-09T02:03:23.265Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:01:03.609Z"}}},"related_cves":[{"value":"CVE-2026-93678","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:60e7044f-e344-4f58-a4e7-613e5c7d5132","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93678","advisory_id":"60e7044f-e344-4f58-a4e7-613e5c7d5132","event_types":["advisory"],"published_at":"2026-10-25T01:12:21.641335+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:01:03.609+00:00","detail_url":"/events/16163"}]}},{"id":16259,"cve_ids":["CVE-2026-93448"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.","evidence":"cve:CVE-2026-93448","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93448","aliases":["CVE-2026-93448"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-09T02:03:50.075Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93448","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-09T02:03:40.689803Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-09T02:03:50.075Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:02:18.969Z"}}},"related_cves":[{"value":"CVE-2026-93448","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:88e7fd08-541e-4074-9b7c-1c666980239d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93448","advisory_id":"88e7fd08-541e-4074-9b7c-1c666980239d","event_types":["advisory"],"published_at":"2026-10-25T01:12:20.878548+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:02:18.969+00:00","detail_url":"/advisories/advisory%3A88e7fd08-541e-4074-9b7c-1c666980239d","group":{"id":"advisory:88e7fd08-541e-4074-9b7c-1c666980239d","revision":1,"primary_event_id":16162,"change":"published","superseded_by":[],"changed":{"id":16162,"cve_ids":["CVE-2026-93448"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.","evidence":"cve:CVE-2026-93448","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93448","aliases":["CVE-2026-93448"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-09T02:03:50.075Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93448","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-09T02:03:40.689803Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-09T02:03:50.075Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:02:18.969Z"}}},"related_cves":[{"value":"CVE-2026-93448","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:88e7fd08-541e-4074-9b7c-1c666980239d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93448","advisory_id":"88e7fd08-541e-4074-9b7c-1c666980239d","event_types":["advisory"],"published_at":"2026-10-25T01:12:20.878548+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:02:18.969+00:00","detail_url":"/events/16162"},"members":[{"id":16162,"cve_ids":["CVE-2026-93448"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.","evidence":"cve:CVE-2026-93448","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93448","aliases":["CVE-2026-93448"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-09T02:03:50.075Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93448","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-09T02:03:40.689803Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-09T02:03:50.075Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:02:18.969Z"}}},"related_cves":[{"value":"CVE-2026-93448","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:88e7fd08-541e-4074-9b7c-1c666980239d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93448","advisory_id":"88e7fd08-541e-4074-9b7c-1c666980239d","event_types":["advisory"],"published_at":"2026-10-25T01:12:20.878548+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:02:18.969+00:00","detail_url":"/events/16162"}]}},{"id":12634,"cve_ids":["CVE-2026-101329"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.","evidence":"cve:CVE-2026-101329","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101329","aliases":["CVE-2026-101329"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T14:53:58.374Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101329","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T14:53:45.750399Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T14:53:58.374Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:58:47.055Z"}}},"related_cves":[{"value":"CVE-2026-101329","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:09fd829b-84f9-4258-8b1a-c18b0ada453e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101329","advisory_id":"09fd829b-84f9-4258-8b1a-c18b0ada453e","event_types":["advisory"],"published_at":"2026-10-25T00:09:57.612146+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:58:47.055+00:00","detail_url":"/advisories/advisory%3A09fd829b-84f9-4258-8b1a-c18b0ada453e","group":{"id":"advisory:09fd829b-84f9-4258-8b1a-c18b0ada453e","revision":1,"primary_event_id":12571,"change":"published","superseded_by":[],"changed":{"id":12571,"cve_ids":["CVE-2026-101329"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.","evidence":"cve:CVE-2026-101329","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101329","aliases":["CVE-2026-101329"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T14:53:58.374Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101329","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T14:53:45.750399Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T14:53:58.374Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:58:47.055Z"}}},"related_cves":[{"value":"CVE-2026-101329","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:09fd829b-84f9-4258-8b1a-c18b0ada453e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101329","advisory_id":"09fd829b-84f9-4258-8b1a-c18b0ada453e","event_types":["advisory"],"published_at":"2026-10-25T00:09:57.612146+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:58:47.055+00:00","detail_url":"/events/12571"},"members":[{"id":12571,"cve_ids":["CVE-2026-101329"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.","evidence":"cve:CVE-2026-101329","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101329","aliases":["CVE-2026-101329"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T14:53:58.374Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101329","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T14:53:45.750399Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T14:53:58.374Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:58:47.055Z"}}},"related_cves":[{"value":"CVE-2026-101329","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:09fd829b-84f9-4258-8b1a-c18b0ada453e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101329","advisory_id":"09fd829b-84f9-4258-8b1a-c18b0ada453e","event_types":["advisory"],"published_at":"2026-10-25T00:09:57.612146+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:58:47.055+00:00","detail_url":"/events/12571"}]}},{"id":12541,"cve_ids":["CVE-2026-97678"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.","evidence":"cve:CVE-2026-97678","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97678","aliases":["CVE-2026-97678"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T13:00:06.870Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97678","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:56:02.073416Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T13:00:06.870Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:59:43.554Z"}}},"related_cves":[{"value":"CVE-2026-97678","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a08637e8-3ca5-4b55-98c1-ffcc9b8fe6be","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97678","advisory_id":"a08637e8-3ca5-4b55-98c1-ffcc9b8fe6be","event_types":["advisory"],"published_at":"2026-10-25T00:08:17.567999+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:59:43.554+00:00","detail_url":"/advisories/advisory%3Aa08637e8-3ca5-4b55-98c1-ffcc9b8fe6be","group":{"id":"advisory:a08637e8-3ca5-4b55-98c1-ffcc9b8fe6be","revision":1,"primary_event_id":12480,"change":"published","superseded_by":[],"changed":{"id":12480,"cve_ids":["CVE-2026-97678"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.","evidence":"cve:CVE-2026-97678","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97678","aliases":["CVE-2026-97678"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T13:00:06.870Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97678","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:56:02.073416Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T13:00:06.870Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:59:43.554Z"}}},"related_cves":[{"value":"CVE-2026-97678","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a08637e8-3ca5-4b55-98c1-ffcc9b8fe6be","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97678","advisory_id":"a08637e8-3ca5-4b55-98c1-ffcc9b8fe6be","event_types":["advisory"],"published_at":"2026-10-25T00:08:17.567999+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:59:43.554+00:00","detail_url":"/events/12480"},"members":[{"id":12480,"cve_ids":["CVE-2026-97678"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.","evidence":"cve:CVE-2026-97678","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97678","aliases":["CVE-2026-97678"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T13:00:06.870Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97678","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:56:02.073416Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T13:00:06.870Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:59:43.554Z"}}},"related_cves":[{"value":"CVE-2026-97678","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a08637e8-3ca5-4b55-98c1-ffcc9b8fe6be","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97678","advisory_id":"a08637e8-3ca5-4b55-98c1-ffcc9b8fe6be","event_types":["advisory"],"published_at":"2026-10-25T00:08:17.567999+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:59:43.554+00:00","detail_url":"/events/12480"}]}},{"id":12540,"cve_ids":["CVE-2026-97674"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command ('Code Injection'), aka improper control of code generation.","evidence":"cve:CVE-2026-97674","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97674","aliases":["CVE-2026-97674"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T13:00:07.028Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:56:00.387172Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T13:00:07.028Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:59:56.989Z"}}},"related_cves":[{"value":"CVE-2026-97674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:af21df12-e541-42a9-949b-30be21e5dc57","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97674","advisory_id":"af21df12-e541-42a9-949b-30be21e5dc57","event_types":["advisory"],"published_at":"2026-10-25T00:08:16.961051+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:59:56.989+00:00","detail_url":"/advisories/advisory%3Aaf21df12-e541-42a9-949b-30be21e5dc57","group":{"id":"advisory:af21df12-e541-42a9-949b-30be21e5dc57","revision":1,"primary_event_id":12479,"change":"published","superseded_by":[],"changed":{"id":12479,"cve_ids":["CVE-2026-97674"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command ('Code Injection'), aka improper control of code generation.","evidence":"cve:CVE-2026-97674","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97674","aliases":["CVE-2026-97674"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T13:00:07.028Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:56:00.387172Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T13:00:07.028Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:59:56.989Z"}}},"related_cves":[{"value":"CVE-2026-97674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:af21df12-e541-42a9-949b-30be21e5dc57","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97674","advisory_id":"af21df12-e541-42a9-949b-30be21e5dc57","event_types":["advisory"],"published_at":"2026-10-25T00:08:16.961051+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:59:56.989+00:00","detail_url":"/events/12479"},"members":[{"id":12479,"cve_ids":["CVE-2026-97674"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command ('Code Injection'), aka improper control of code generation.","evidence":"cve:CVE-2026-97674","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97674","aliases":["CVE-2026-97674"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T13:00:07.028Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:56:00.387172Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T13:00:07.028Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:59:56.989Z"}}},"related_cves":[{"value":"CVE-2026-97674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:af21df12-e541-42a9-949b-30be21e5dc57","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97674","advisory_id":"af21df12-e541-42a9-949b-30be21e5dc57","event_types":["advisory"],"published_at":"2026-10-25T00:08:16.961051+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:59:56.989+00:00","detail_url":"/events/12479"}]}},{"id":12539,"cve_ids":["CVE-2026-97655"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner.","evidence":"cve:CVE-2026-97655","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97655","aliases":["CVE-2026-97655"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T13:00:06.737Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97655","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:56:04.183239Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T13:00:06.737Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:59:07.370Z"}}},"related_cves":[{"value":"CVE-2026-97655","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5940f6a8-d6f1-4aa1-a287-ec7d2a1275b9","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97655","advisory_id":"5940f6a8-d6f1-4aa1-a287-ec7d2a1275b9","event_types":["advisory"],"published_at":"2026-10-25T00:08:16.35431+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:59:07.37+00:00","detail_url":"/advisories/advisory%3A5940f6a8-d6f1-4aa1-a287-ec7d2a1275b9","group":{"id":"advisory:5940f6a8-d6f1-4aa1-a287-ec7d2a1275b9","revision":1,"primary_event_id":12478,"change":"published","superseded_by":[],"changed":{"id":12478,"cve_ids":["CVE-2026-97655"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner.","evidence":"cve:CVE-2026-97655","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97655","aliases":["CVE-2026-97655"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T13:00:06.737Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97655","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:56:04.183239Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T13:00:06.737Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:59:07.370Z"}}},"related_cves":[{"value":"CVE-2026-97655","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5940f6a8-d6f1-4aa1-a287-ec7d2a1275b9","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97655","advisory_id":"5940f6a8-d6f1-4aa1-a287-ec7d2a1275b9","event_types":["advisory"],"published_at":"2026-10-25T00:08:16.35431+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:59:07.37+00:00","detail_url":"/events/12478"},"members":[{"id":12478,"cve_ids":["CVE-2026-97655"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner.","evidence":"cve:CVE-2026-97655","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97655","aliases":["CVE-2026-97655"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T13:00:06.737Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97655","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:56:04.183239Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T13:00:06.737Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:59:07.370Z"}}},"related_cves":[{"value":"CVE-2026-97655","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5940f6a8-d6f1-4aa1-a287-ec7d2a1275b9","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97655","advisory_id":"5940f6a8-d6f1-4aa1-a287-ec7d2a1275b9","event_types":["advisory"],"published_at":"2026-10-25T00:08:16.35431+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:59:07.37+00:00","detail_url":"/events/12478"}]}},{"id":12538,"cve_ids":["CVE-2026-93674"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.","evidence":"cve:CVE-2026-93674","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-93674","aliases":["CVE-2026-93674"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T13:00:07.169Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:55:58.786823Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T13:00:07.169Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:00:37.686Z"}}},"related_cves":[{"value":"CVE-2026-93674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9eb54277-12c4-428c-836d-4492ce16fca2","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93674","advisory_id":"9eb54277-12c4-428c-836d-4492ce16fca2","event_types":["advisory"],"published_at":"2026-10-25T00:08:15.786294+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:00:37.686+00:00","detail_url":"/advisories/advisory%3A9eb54277-12c4-428c-836d-4492ce16fca2","group":{"id":"advisory:9eb54277-12c4-428c-836d-4492ce16fca2","revision":1,"primary_event_id":12477,"change":"published","superseded_by":[],"changed":{"id":12477,"cve_ids":["CVE-2026-93674"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.","evidence":"cve:CVE-2026-93674","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-93674","aliases":["CVE-2026-93674"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T13:00:07.169Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:55:58.786823Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T13:00:07.169Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:00:37.686Z"}}},"related_cves":[{"value":"CVE-2026-93674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9eb54277-12c4-428c-836d-4492ce16fca2","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93674","advisory_id":"9eb54277-12c4-428c-836d-4492ce16fca2","event_types":["advisory"],"published_at":"2026-10-25T00:08:15.786294+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:00:37.686+00:00","detail_url":"/events/12477"},"members":[{"id":12477,"cve_ids":["CVE-2026-93674"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.","evidence":"cve:CVE-2026-93674","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-93674","aliases":["CVE-2026-93674"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T13:00:07.169Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:55:58.786823Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T13:00:07.169Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:00:37.686Z"}}},"related_cves":[{"value":"CVE-2026-93674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9eb54277-12c4-428c-836d-4492ce16fca2","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93674","advisory_id":"9eb54277-12c4-428c-836d-4492ce16fca2","event_types":["advisory"],"published_at":"2026-10-25T00:08:15.786294+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:00:37.686+00:00","detail_url":"/events/12477"}]}},{"id":12537,"cve_ids":["CVE-2026-93443"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.","evidence":"cve:CVE-2026-93443","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93443","aliases":["CVE-2026-93443"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T13:00:07.304Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93443","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:55:55.316108Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T13:00:07.304Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:02:36.304Z"}}},"related_cves":[{"value":"CVE-2026-93443","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e62652cb-6f85-443f-b2ef-59fd9628ea14","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93443","advisory_id":"e62652cb-6f85-443f-b2ef-59fd9628ea14","event_types":["advisory"],"published_at":"2026-10-25T00:08:15.180277+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:02:36.304+00:00","detail_url":"/advisories/advisory%3Ae62652cb-6f85-443f-b2ef-59fd9628ea14","group":{"id":"advisory:e62652cb-6f85-443f-b2ef-59fd9628ea14","revision":1,"primary_event_id":12476,"change":"published","superseded_by":[],"changed":{"id":12476,"cve_ids":["CVE-2026-93443"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.","evidence":"cve:CVE-2026-93443","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93443","aliases":["CVE-2026-93443"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T13:00:07.304Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93443","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:55:55.316108Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T13:00:07.304Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:02:36.304Z"}}},"related_cves":[{"value":"CVE-2026-93443","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e62652cb-6f85-443f-b2ef-59fd9628ea14","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93443","advisory_id":"e62652cb-6f85-443f-b2ef-59fd9628ea14","event_types":["advisory"],"published_at":"2026-10-25T00:08:15.180277+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:02:36.304+00:00","detail_url":"/events/12476"},"members":[{"id":12476,"cve_ids":["CVE-2026-93443"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.","evidence":"cve:CVE-2026-93443","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93443","aliases":["CVE-2026-93443"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T13:00:07.304Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93443","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:55:55.316108Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T13:00:07.304Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:02:36.304Z"}}},"related_cves":[{"value":"CVE-2026-93443","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e62652cb-6f85-443f-b2ef-59fd9628ea14","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93443","advisory_id":"e62652cb-6f85-443f-b2ef-59fd9628ea14","event_types":["advisory"],"published_at":"2026-10-25T00:08:15.180277+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:02:36.304+00:00","detail_url":"/events/12476"}]}},{"id":12524,"cve_ids":["CVE-2026-104334"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.","evidence":"cve:CVE-2026-104334","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-104334","aliases":["CVE-2026-104334"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T12:57:38.114Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-104334","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:56:06.302484Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T12:57:38.114Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:57:57.605Z"}}},"related_cves":[{"value":"CVE-2026-104334","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ca1ba93b-6afa-4bcd-91da-193e09a63242","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104334","advisory_id":"ca1ba93b-6afa-4bcd-91da-193e09a63242","event_types":["advisory"],"published_at":"2026-10-25T00:08:06.992629+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:57:57.605+00:00","detail_url":"/advisories/advisory%3Aca1ba93b-6afa-4bcd-91da-193e09a63242","group":{"id":"advisory:ca1ba93b-6afa-4bcd-91da-193e09a63242","revision":1,"primary_event_id":12463,"change":"published","superseded_by":[],"changed":{"id":12463,"cve_ids":["CVE-2026-104334"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.","evidence":"cve:CVE-2026-104334","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-104334","aliases":["CVE-2026-104334"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T12:57:38.114Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-104334","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:56:06.302484Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T12:57:38.114Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:57:57.605Z"}}},"related_cves":[{"value":"CVE-2026-104334","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ca1ba93b-6afa-4bcd-91da-193e09a63242","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104334","advisory_id":"ca1ba93b-6afa-4bcd-91da-193e09a63242","event_types":["advisory"],"published_at":"2026-10-25T00:08:06.992629+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:57:57.605+00:00","detail_url":"/events/12463"},"members":[{"id":12463,"cve_ids":["CVE-2026-104334"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.","evidence":"cve:CVE-2026-104334","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-104334","aliases":["CVE-2026-104334"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T12:57:38.114Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-104334","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T03:56:06.302484Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T12:57:38.114Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:57:57.605Z"}}},"related_cves":[{"value":"CVE-2026-104334","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ca1ba93b-6afa-4bcd-91da-193e09a63242","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104334","advisory_id":"ca1ba93b-6afa-4bcd-91da-193e09a63242","event_types":["advisory"],"published_at":"2026-10-25T00:08:06.992629+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:57:57.605+00:00","detail_url":"/events/12463"}]}},{"id":12473,"cve_ids":["CVE-2026-97680"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem.","evidence":"cve:CVE-2026-97680","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97680","aliases":["CVE-2026-97680"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:56:02.435Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97680","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:56:02.435Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:59:21.197Z"}}},"related_cves":[{"value":"CVE-2026-97680","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a3764ff7-15a9-437e-be47-8f05f564fb2b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97680","advisory_id":"a3764ff7-15a9-437e-be47-8f05f564fb2b","event_types":["advisory"],"published_at":"2026-10-25T00:07:33.092855+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:59:21.197+00:00","detail_url":"/advisories/advisory%3Aa3764ff7-15a9-437e-be47-8f05f564fb2b","group":{"id":"advisory:a3764ff7-15a9-437e-be47-8f05f564fb2b","revision":1,"primary_event_id":12412,"change":"published","superseded_by":[],"changed":{"id":12412,"cve_ids":["CVE-2026-97680"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem.","evidence":"cve:CVE-2026-97680","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97680","aliases":["CVE-2026-97680"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:56:02.435Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97680","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:56:02.435Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:59:21.197Z"}}},"related_cves":[{"value":"CVE-2026-97680","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a3764ff7-15a9-437e-be47-8f05f564fb2b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97680","advisory_id":"a3764ff7-15a9-437e-be47-8f05f564fb2b","event_types":["advisory"],"published_at":"2026-10-25T00:07:33.092855+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:59:21.197+00:00","detail_url":"/events/12412"},"members":[{"id":12412,"cve_ids":["CVE-2026-97680"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem.","evidence":"cve:CVE-2026-97680","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97680","aliases":["CVE-2026-97680"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:56:02.435Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97680","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:56:02.435Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:59:21.197Z"}}},"related_cves":[{"value":"CVE-2026-97680","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a3764ff7-15a9-437e-be47-8f05f564fb2b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97680","advisory_id":"a3764ff7-15a9-437e-be47-8f05f564fb2b","event_types":["advisory"],"published_at":"2026-10-25T00:07:33.092855+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:59:21.197+00:00","detail_url":"/events/12412"}]}},{"id":12472,"cve_ids":["CVE-2026-97679"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation.","evidence":"cve:CVE-2026-97679","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97679","aliases":["CVE-2026-97679"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:56:00.675Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97679","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:56:00.675Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:59:33.248Z"}}},"related_cves":[{"value":"CVE-2026-97679","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5a8d30a2-085d-4432-bd98-a55e70ab1b4a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97679","advisory_id":"5a8d30a2-085d-4432-bd98-a55e70ab1b4a","event_types":["advisory"],"published_at":"2026-10-25T00:07:32.33651+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:59:33.248+00:00","detail_url":"/advisories/advisory%3A5a8d30a2-085d-4432-bd98-a55e70ab1b4a","group":{"id":"advisory:5a8d30a2-085d-4432-bd98-a55e70ab1b4a","revision":1,"primary_event_id":12411,"change":"published","superseded_by":[],"changed":{"id":12411,"cve_ids":["CVE-2026-97679"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation.","evidence":"cve:CVE-2026-97679","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97679","aliases":["CVE-2026-97679"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:56:00.675Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97679","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:56:00.675Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:59:33.248Z"}}},"related_cves":[{"value":"CVE-2026-97679","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5a8d30a2-085d-4432-bd98-a55e70ab1b4a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97679","advisory_id":"5a8d30a2-085d-4432-bd98-a55e70ab1b4a","event_types":["advisory"],"published_at":"2026-10-25T00:07:32.33651+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:59:33.248+00:00","detail_url":"/events/12411"},"members":[{"id":12411,"cve_ids":["CVE-2026-97679"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation.","evidence":"cve:CVE-2026-97679","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97679","aliases":["CVE-2026-97679"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:56:00.675Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97679","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:56:00.675Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:59:33.248Z"}}},"related_cves":[{"value":"CVE-2026-97679","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5a8d30a2-085d-4432-bd98-a55e70ab1b4a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97679","advisory_id":"5a8d30a2-085d-4432-bd98-a55e70ab1b4a","event_types":["advisory"],"published_at":"2026-10-25T00:07:32.33651+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:59:33.248+00:00","detail_url":"/events/12411"}]}},{"id":12471,"cve_ids":["CVE-2026-97676"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code, resulting in a sandbox escape.","evidence":"cve:CVE-2026-97676","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97676","aliases":["CVE-2026-97676"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:56:04.519Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97676","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:56:04.519Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:58:57.606Z"}}},"related_cves":[{"value":"CVE-2026-97676","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0d21ad55-eab3-4ebb-b0d4-c4aff307e05a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97676","advisory_id":"0d21ad55-eab3-4ebb-b0d4-c4aff307e05a","event_types":["advisory"],"published_at":"2026-10-25T00:07:31.750195+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:58:57.606+00:00","detail_url":"/advisories/advisory%3A0d21ad55-eab3-4ebb-b0d4-c4aff307e05a","group":{"id":"advisory:0d21ad55-eab3-4ebb-b0d4-c4aff307e05a","revision":1,"primary_event_id":12410,"change":"published","superseded_by":[],"changed":{"id":12410,"cve_ids":["CVE-2026-97676"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code, resulting in a sandbox escape.","evidence":"cve:CVE-2026-97676","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97676","aliases":["CVE-2026-97676"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:56:04.519Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97676","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:56:04.519Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:58:57.606Z"}}},"related_cves":[{"value":"CVE-2026-97676","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0d21ad55-eab3-4ebb-b0d4-c4aff307e05a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97676","advisory_id":"0d21ad55-eab3-4ebb-b0d4-c4aff307e05a","event_types":["advisory"],"published_at":"2026-10-25T00:07:31.750195+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:58:57.606+00:00","detail_url":"/events/12410"},"members":[{"id":12410,"cve_ids":["CVE-2026-97676"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code, resulting in a sandbox escape.","evidence":"cve:CVE-2026-97676","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97676","aliases":["CVE-2026-97676"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:56:04.519Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97676","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:56:04.519Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:58:57.606Z"}}},"related_cves":[{"value":"CVE-2026-97676","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0d21ad55-eab3-4ebb-b0d4-c4aff307e05a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97676","advisory_id":"0d21ad55-eab3-4ebb-b0d4-c4aff307e05a","event_types":["advisory"],"published_at":"2026-10-25T00:07:31.750195+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:58:57.606+00:00","detail_url":"/events/12410"}]}},{"id":12470,"cve_ids":["CVE-2026-97673"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.","evidence":"cve:CVE-2026-97673","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97673","aliases":["CVE-2026-97673"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:59.070Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97673","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:59.070Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:00:11.043Z"}}},"related_cves":[{"value":"CVE-2026-97673","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:445c3463-f1b5-4f51-8641-64969e6e2cd1","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97673","advisory_id":"445c3463-f1b5-4f51-8641-64969e6e2cd1","event_types":["advisory"],"published_at":"2026-10-25T00:07:31.070034+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:00:11.043+00:00","detail_url":"/advisories/advisory%3A445c3463-f1b5-4f51-8641-64969e6e2cd1","group":{"id":"advisory:445c3463-f1b5-4f51-8641-64969e6e2cd1","revision":1,"primary_event_id":12409,"change":"published","superseded_by":[],"changed":{"id":12409,"cve_ids":["CVE-2026-97673"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.","evidence":"cve:CVE-2026-97673","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97673","aliases":["CVE-2026-97673"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:59.070Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97673","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:59.070Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:00:11.043Z"}}},"related_cves":[{"value":"CVE-2026-97673","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:445c3463-f1b5-4f51-8641-64969e6e2cd1","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97673","advisory_id":"445c3463-f1b5-4f51-8641-64969e6e2cd1","event_types":["advisory"],"published_at":"2026-10-25T00:07:31.070034+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:00:11.043+00:00","detail_url":"/events/12409"},"members":[{"id":12409,"cve_ids":["CVE-2026-97673"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.","evidence":"cve:CVE-2026-97673","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97673","aliases":["CVE-2026-97673"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:59.070Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97673","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:59.070Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:00:11.043Z"}}},"related_cves":[{"value":"CVE-2026-97673","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:445c3463-f1b5-4f51-8641-64969e6e2cd1","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97673","advisory_id":"445c3463-f1b5-4f51-8641-64969e6e2cd1","event_types":["advisory"],"published_at":"2026-10-25T00:07:31.070034+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:00:11.043+00:00","detail_url":"/events/12409"}]}},{"id":12469,"cve_ids":["CVE-2026-93675"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.","evidence":"cve:CVE-2026-93675","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93675","aliases":["CVE-2026-93675"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:57.713Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93675","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:57.713Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:01:27.358Z"}}},"related_cves":[{"value":"CVE-2026-93675","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:86840802-ef79-4fe4-9d71-c533a84dd1fc","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93675","advisory_id":"86840802-ef79-4fe4-9d71-c533a84dd1fc","event_types":["advisory"],"published_at":"2026-10-25T00:07:30.303005+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:01:27.358+00:00","detail_url":"/advisories/advisory%3A86840802-ef79-4fe4-9d71-c533a84dd1fc","group":{"id":"advisory:86840802-ef79-4fe4-9d71-c533a84dd1fc","revision":1,"primary_event_id":12408,"change":"published","superseded_by":[],"changed":{"id":12408,"cve_ids":["CVE-2026-93675"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.","evidence":"cve:CVE-2026-93675","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93675","aliases":["CVE-2026-93675"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:57.713Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93675","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:57.713Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:01:27.358Z"}}},"related_cves":[{"value":"CVE-2026-93675","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:86840802-ef79-4fe4-9d71-c533a84dd1fc","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93675","advisory_id":"86840802-ef79-4fe4-9d71-c533a84dd1fc","event_types":["advisory"],"published_at":"2026-10-25T00:07:30.303005+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:01:27.358+00:00","detail_url":"/events/12408"},"members":[{"id":12408,"cve_ids":["CVE-2026-93675"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.","evidence":"cve:CVE-2026-93675","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93675","aliases":["CVE-2026-93675"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:57.713Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93675","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:57.713Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:01:27.358Z"}}},"related_cves":[{"value":"CVE-2026-93675","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:86840802-ef79-4fe4-9d71-c533a84dd1fc","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93675","advisory_id":"86840802-ef79-4fe4-9d71-c533a84dd1fc","event_types":["advisory"],"published_at":"2026-10-25T00:07:30.303005+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:01:27.358+00:00","detail_url":"/events/12408"}]}},{"id":12468,"cve_ids":["CVE-2026-93445"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.","evidence":"cve:CVE-2026-93445","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93445","aliases":["CVE-2026-93445"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:56.288Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93445","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:56.288Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:01:50.791Z"}}},"related_cves":[{"value":"CVE-2026-93445","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:959fc02d-6c71-4551-91fa-b601b9af790f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93445","advisory_id":"959fc02d-6c71-4551-91fa-b601b9af790f","event_types":["advisory"],"published_at":"2026-10-25T00:07:29.685101+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:01:50.791+00:00","detail_url":"/advisories/advisory%3A959fc02d-6c71-4551-91fa-b601b9af790f","group":{"id":"advisory:959fc02d-6c71-4551-91fa-b601b9af790f","revision":1,"primary_event_id":12407,"change":"published","superseded_by":[],"changed":{"id":12407,"cve_ids":["CVE-2026-93445"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.","evidence":"cve:CVE-2026-93445","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93445","aliases":["CVE-2026-93445"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:56.288Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93445","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:56.288Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:01:50.791Z"}}},"related_cves":[{"value":"CVE-2026-93445","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:959fc02d-6c71-4551-91fa-b601b9af790f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93445","advisory_id":"959fc02d-6c71-4551-91fa-b601b9af790f","event_types":["advisory"],"published_at":"2026-10-25T00:07:29.685101+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:01:50.791+00:00","detail_url":"/events/12407"},"members":[{"id":12407,"cve_ids":["CVE-2026-93445"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.","evidence":"cve:CVE-2026-93445","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93445","aliases":["CVE-2026-93445"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:56.288Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93445","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:56.288Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:01:50.791Z"}}},"related_cves":[{"value":"CVE-2026-93445","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:959fc02d-6c71-4551-91fa-b601b9af790f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93445","advisory_id":"959fc02d-6c71-4551-91fa-b601b9af790f","event_types":["advisory"],"published_at":"2026-10-25T00:07:29.685101+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:01:50.791+00:00","detail_url":"/events/12407"}]}},{"id":12467,"cve_ids":["CVE-2026-93449"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.","evidence":"cve:CVE-2026-93449","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93449","aliases":["CVE-2026-93449"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:55.610Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93449","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:55.610Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:02:05.322Z"}}},"related_cves":[{"value":"CVE-2026-93449","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ebb2ccdd-1463-4045-ba8a-a30e877bdedd","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93449","advisory_id":"ebb2ccdd-1463-4045-ba8a-a30e877bdedd","event_types":["advisory"],"published_at":"2026-10-25T00:07:28.820766+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:02:05.322+00:00","detail_url":"/advisories/advisory%3Aebb2ccdd-1463-4045-ba8a-a30e877bdedd","group":{"id":"advisory:ebb2ccdd-1463-4045-ba8a-a30e877bdedd","revision":1,"primary_event_id":12406,"change":"published","superseded_by":[],"changed":{"id":12406,"cve_ids":["CVE-2026-93449"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.","evidence":"cve:CVE-2026-93449","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93449","aliases":["CVE-2026-93449"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:55.610Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93449","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:55.610Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:02:05.322Z"}}},"related_cves":[{"value":"CVE-2026-93449","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ebb2ccdd-1463-4045-ba8a-a30e877bdedd","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93449","advisory_id":"ebb2ccdd-1463-4045-ba8a-a30e877bdedd","event_types":["advisory"],"published_at":"2026-10-25T00:07:28.820766+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:02:05.322+00:00","detail_url":"/events/12406"},"members":[{"id":12406,"cve_ids":["CVE-2026-93449"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.","evidence":"cve:CVE-2026-93449","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93449","aliases":["CVE-2026-93449"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:55.610Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93449","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:55.610Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:02:05.322Z"}}},"related_cves":[{"value":"CVE-2026-93449","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ebb2ccdd-1463-4045-ba8a-a30e877bdedd","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93449","advisory_id":"ebb2ccdd-1463-4045-ba8a-a30e877bdedd","event_types":["advisory"],"published_at":"2026-10-25T00:07:28.820766+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:02:05.322+00:00","detail_url":"/events/12406"}]}},{"id":12466,"cve_ids":["CVE-2026-93447"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with the privileges of the service process.","evidence":"cve:CVE-2026-93447","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93447","aliases":["CVE-2026-93447"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:57.011Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93447","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:57.011Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:01:39.959Z"}}},"related_cves":[{"value":"CVE-2026-93447","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3b97fac4-8ba6-4182-9921-faffd32f172e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93447","advisory_id":"3b97fac4-8ba6-4182-9921-faffd32f172e","event_types":["advisory"],"published_at":"2026-10-25T00:07:28.045088+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:01:39.959+00:00","detail_url":"/advisories/advisory%3A3b97fac4-8ba6-4182-9921-faffd32f172e","group":{"id":"advisory:3b97fac4-8ba6-4182-9921-faffd32f172e","revision":1,"primary_event_id":12405,"change":"published","superseded_by":[],"changed":{"id":12405,"cve_ids":["CVE-2026-93447"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with the privileges of the service process.","evidence":"cve:CVE-2026-93447","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93447","aliases":["CVE-2026-93447"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:57.011Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93447","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:57.011Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:01:39.959Z"}}},"related_cves":[{"value":"CVE-2026-93447","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3b97fac4-8ba6-4182-9921-faffd32f172e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93447","advisory_id":"3b97fac4-8ba6-4182-9921-faffd32f172e","event_types":["advisory"],"published_at":"2026-10-25T00:07:28.045088+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:01:39.959+00:00","detail_url":"/events/12405"},"members":[{"id":12405,"cve_ids":["CVE-2026-93447"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with the privileges of the service process.","evidence":"cve:CVE-2026-93447","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93447","aliases":["CVE-2026-93447"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:57.011Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93447","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:57.011Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:01:39.959Z"}}},"related_cves":[{"value":"CVE-2026-93447","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3b97fac4-8ba6-4182-9921-faffd32f172e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93447","advisory_id":"3b97fac4-8ba6-4182-9921-faffd32f172e","event_types":["advisory"],"published_at":"2026-10-25T00:07:28.045088+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:01:39.959+00:00","detail_url":"/events/12405"}]}},{"id":12465,"cve_ids":["CVE-2026-88962"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.","evidence":"cve:CVE-2026-88962","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-88962","aliases":["CVE-2026-88962"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:54.141Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-88962","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:54.141Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:02:53.758Z"}}},"related_cves":[{"value":"CVE-2026-88962","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1bbc0eba-b142-4370-bc88-5e0c9fc6cd82","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88962","advisory_id":"1bbc0eba-b142-4370-bc88-5e0c9fc6cd82","event_types":["advisory"],"published_at":"2026-10-25T00:07:27.482799+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:02:53.758+00:00","detail_url":"/advisories/advisory%3A1bbc0eba-b142-4370-bc88-5e0c9fc6cd82","group":{"id":"advisory:1bbc0eba-b142-4370-bc88-5e0c9fc6cd82","revision":1,"primary_event_id":12404,"change":"published","superseded_by":[],"changed":{"id":12404,"cve_ids":["CVE-2026-88962"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.","evidence":"cve:CVE-2026-88962","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-88962","aliases":["CVE-2026-88962"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:54.141Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-88962","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:54.141Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:02:53.758Z"}}},"related_cves":[{"value":"CVE-2026-88962","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1bbc0eba-b142-4370-bc88-5e0c9fc6cd82","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88962","advisory_id":"1bbc0eba-b142-4370-bc88-5e0c9fc6cd82","event_types":["advisory"],"published_at":"2026-10-25T00:07:27.482799+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:02:53.758+00:00","detail_url":"/events/12404"},"members":[{"id":12404,"cve_ids":["CVE-2026-88962"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.","evidence":"cve:CVE-2026-88962","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-88962","aliases":["CVE-2026-88962"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:55:54.141Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-88962","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:55:54.141Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:02:53.758Z"}}},"related_cves":[{"value":"CVE-2026-88962","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1bbc0eba-b142-4370-bc88-5e0c9fc6cd82","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88962","advisory_id":"1bbc0eba-b142-4370-bc88-5e0c9fc6cd82","event_types":["advisory"],"published_at":"2026-10-25T00:07:27.482799+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:02:53.758+00:00","detail_url":"/events/12404"}]}},{"id":12426,"cve_ids":["CVE-2026-104335"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control.","evidence":"cve:CVE-2026-104335","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-104335","aliases":["CVE-2026-104335"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:56:06.609Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-104335","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:56:06.609Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:57:43.840Z"}}},"related_cves":[{"value":"CVE-2026-104335","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b63edeac-e265-43cc-9f99-225c9d67a8fd","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104335","advisory_id":"b63edeac-e265-43cc-9f99-225c9d67a8fd","event_types":["advisory"],"published_at":"2026-10-25T00:05:55.526294+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:57:43.84+00:00","detail_url":"/advisories/advisory%3Ab63edeac-e265-43cc-9f99-225c9d67a8fd","group":{"id":"advisory:b63edeac-e265-43cc-9f99-225c9d67a8fd","revision":1,"primary_event_id":12366,"change":"published","superseded_by":[],"changed":{"id":12366,"cve_ids":["CVE-2026-104335"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control.","evidence":"cve:CVE-2026-104335","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-104335","aliases":["CVE-2026-104335"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:56:06.609Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-104335","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:56:06.609Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:57:43.840Z"}}},"related_cves":[{"value":"CVE-2026-104335","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b63edeac-e265-43cc-9f99-225c9d67a8fd","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104335","advisory_id":"b63edeac-e265-43cc-9f99-225c9d67a8fd","event_types":["advisory"],"published_at":"2026-10-25T00:05:55.526294+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:57:43.84+00:00","detail_url":"/events/12366"},"members":[{"id":12366,"cve_ids":["CVE-2026-104335"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control.","evidence":"cve:CVE-2026-104335","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-104335","aliases":["CVE-2026-104335"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:56:06.609Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-104335","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:56:06.609Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:57:43.840Z"}}},"related_cves":[{"value":"CVE-2026-104335","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b63edeac-e265-43cc-9f99-225c9d67a8fd","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104335","advisory_id":"b63edeac-e265-43cc-9f99-225c9d67a8fd","event_types":["advisory"],"published_at":"2026-10-25T00:05:55.526294+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:57:43.84+00:00","detail_url":"/events/12366"}]}},{"id":12425,"cve_ids":["CVE-2026-103360"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.","evidence":"cve:CVE-2026-103360","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-103360","aliases":["CVE-2026-103360"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:56:05.230Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-103360","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:56:05.230Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:58:15.921Z"}}},"related_cves":[{"value":"CVE-2026-103360","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c3fe1e3f-3a3c-41e2-acae-a9d25bcd22c7","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103360","advisory_id":"c3fe1e3f-3a3c-41e2-acae-a9d25bcd22c7","event_types":["advisory"],"published_at":"2026-10-25T00:05:54.947435+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:58:15.921+00:00","detail_url":"/advisories/advisory%3Ac3fe1e3f-3a3c-41e2-acae-a9d25bcd22c7","group":{"id":"advisory:c3fe1e3f-3a3c-41e2-acae-a9d25bcd22c7","revision":1,"primary_event_id":12365,"change":"published","superseded_by":[],"changed":{"id":12365,"cve_ids":["CVE-2026-103360"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.","evidence":"cve:CVE-2026-103360","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-103360","aliases":["CVE-2026-103360"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:56:05.230Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-103360","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:56:05.230Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:58:15.921Z"}}},"related_cves":[{"value":"CVE-2026-103360","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c3fe1e3f-3a3c-41e2-acae-a9d25bcd22c7","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103360","advisory_id":"c3fe1e3f-3a3c-41e2-acae-a9d25bcd22c7","event_types":["advisory"],"published_at":"2026-10-25T00:05:54.947435+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:58:15.921+00:00","detail_url":"/events/12365"},"members":[{"id":12365,"cve_ids":["CVE-2026-103360"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.","evidence":"cve:CVE-2026-103360","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-103360","aliases":["CVE-2026-103360"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-08T03:56:05.230Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-103360","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T03:56:05.230Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:58:15.921Z"}}},"related_cves":[{"value":"CVE-2026-103360","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c3fe1e3f-3a3c-41e2-acae-a9d25bcd22c7","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103360","advisory_id":"c3fe1e3f-3a3c-41e2-acae-a9d25bcd22c7","event_types":["advisory"],"published_at":"2026-10-25T00:05:54.947435+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:58:15.921+00:00","detail_url":"/events/12365"}]}},{"id":12090,"cve_ids":["CVE-2026-93677"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to an unauthorized actor.","evidence":"cve:CVE-2026-93677","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93677","aliases":["CVE-2026-93677"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-07T17:05:53.020Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93677","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T15:56:54.506138Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T17:05:53.020Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:01:14.816Z"}}},"related_cves":[{"value":"CVE-2026-93677","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1dd2985a-830c-4de2-8534-84fa21a0a365","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93677","advisory_id":"1dd2985a-830c-4de2-8534-84fa21a0a365","event_types":["advisory"],"published_at":"2026-10-25T00:01:19.528528+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:01:14.816+00:00","detail_url":"/advisories/advisory%3A1dd2985a-830c-4de2-8534-84fa21a0a365","group":{"id":"advisory:1dd2985a-830c-4de2-8534-84fa21a0a365","revision":1,"primary_event_id":12034,"change":"published","superseded_by":[],"changed":{"id":12034,"cve_ids":["CVE-2026-93677"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to an unauthorized actor.","evidence":"cve:CVE-2026-93677","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93677","aliases":["CVE-2026-93677"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-07T17:05:53.020Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93677","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T15:56:54.506138Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T17:05:53.020Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:01:14.816Z"}}},"related_cves":[{"value":"CVE-2026-93677","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1dd2985a-830c-4de2-8534-84fa21a0a365","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93677","advisory_id":"1dd2985a-830c-4de2-8534-84fa21a0a365","event_types":["advisory"],"published_at":"2026-10-25T00:01:19.528528+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:01:14.816+00:00","detail_url":"/events/12034"},"members":[{"id":12034,"cve_ids":["CVE-2026-93677"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to an unauthorized actor.","evidence":"cve:CVE-2026-93677","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93677","aliases":["CVE-2026-93677"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-07T17:05:53.020Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93677","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T15:56:54.506138Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T17:05:53.020Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:01:14.816Z"}}},"related_cves":[{"value":"CVE-2026-93677","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1dd2985a-830c-4de2-8534-84fa21a0a365","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93677","advisory_id":"1dd2985a-830c-4de2-8534-84fa21a0a365","event_types":["advisory"],"published_at":"2026-10-25T00:01:19.528528+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:01:14.816+00:00","detail_url":"/events/12034"}]}},{"id":12057,"cve_ids":["CVE-2026-97671"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.","evidence":"cve:CVE-2026-97671","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-97671","aliases":["CVE-2026-97671"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-07T16:28:38.843Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97671","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T16:28:24.397084Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T16:28:38.843Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:00:26.358Z"}}},"related_cves":[{"value":"CVE-2026-97671","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ac95d471-f0b7-4c75-9edc-c459eddb0e2a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97671","advisory_id":"ac95d471-f0b7-4c75-9edc-c459eddb0e2a","event_types":["advisory"],"published_at":"2026-10-24T23:59:53.768486+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:00:26.358+00:00","detail_url":"/advisories/advisory%3Aac95d471-f0b7-4c75-9edc-c459eddb0e2a","group":{"id":"advisory:ac95d471-f0b7-4c75-9edc-c459eddb0e2a","revision":1,"primary_event_id":12001,"change":"published","superseded_by":[],"changed":{"id":12001,"cve_ids":["CVE-2026-97671"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.","evidence":"cve:CVE-2026-97671","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-97671","aliases":["CVE-2026-97671"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-07T16:28:38.843Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97671","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T16:28:24.397084Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T16:28:38.843Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:00:26.358Z"}}},"related_cves":[{"value":"CVE-2026-97671","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ac95d471-f0b7-4c75-9edc-c459eddb0e2a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97671","advisory_id":"ac95d471-f0b7-4c75-9edc-c459eddb0e2a","event_types":["advisory"],"published_at":"2026-10-24T23:59:53.768486+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:00:26.358+00:00","detail_url":"/events/12001"},"members":[{"id":12001,"cve_ids":["CVE-2026-97671"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.","evidence":"cve:CVE-2026-97671","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-97671","aliases":["CVE-2026-97671"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-07T16:28:38.843Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97671","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T16:28:24.397084Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T16:28:38.843Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:00:26.358Z"}}},"related_cves":[{"value":"CVE-2026-97671","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ac95d471-f0b7-4c75-9edc-c459eddb0e2a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97671","advisory_id":"ac95d471-f0b7-4c75-9edc-c459eddb0e2a","event_types":["advisory"],"published_at":"2026-10-24T23:59:53.768486+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:00:26.358+00:00","detail_url":"/events/12001"}]}},{"id":12048,"cve_ids":["CVE-2026-93679"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during ZIP file extraction.","evidence":"cve:CVE-2026-93679","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93679","aliases":["CVE-2026-93679"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-07T16:18:10.168Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93679","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T16:17:49.540589Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T16:18:10.168Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:00:53.149Z"}}},"related_cves":[{"value":"CVE-2026-93679","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c06dce2d-c4f1-41a7-a4b8-74c180ae06e1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93679","advisory_id":"c06dce2d-c4f1-41a7-a4b8-74c180ae06e1","event_types":["advisory"],"published_at":"2026-10-24T23:59:48.463516+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:00:53.149+00:00","detail_url":"/advisories/advisory%3Ac06dce2d-c4f1-41a7-a4b8-74c180ae06e1","group":{"id":"advisory:c06dce2d-c4f1-41a7-a4b8-74c180ae06e1","revision":1,"primary_event_id":11992,"change":"published","superseded_by":[],"changed":{"id":11992,"cve_ids":["CVE-2026-93679"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during ZIP file extraction.","evidence":"cve:CVE-2026-93679","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93679","aliases":["CVE-2026-93679"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-07T16:18:10.168Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93679","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T16:17:49.540589Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T16:18:10.168Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:00:53.149Z"}}},"related_cves":[{"value":"CVE-2026-93679","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c06dce2d-c4f1-41a7-a4b8-74c180ae06e1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93679","advisory_id":"c06dce2d-c4f1-41a7-a4b8-74c180ae06e1","event_types":["advisory"],"published_at":"2026-10-24T23:59:48.463516+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:00:53.149+00:00","detail_url":"/events/11992"},"members":[{"id":11992,"cve_ids":["CVE-2026-93679"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during ZIP file extraction.","evidence":"cve:CVE-2026-93679","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93679","aliases":["CVE-2026-93679"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-07T16:18:10.168Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93679","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T16:17:49.540589Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T16:18:10.168Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-07T00:00:53.149Z"}}},"related_cves":[{"value":"CVE-2026-93679","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c06dce2d-c4f1-41a7-a4b8-74c180ae06e1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93679","advisory_id":"c06dce2d-c4f1-41a7-a4b8-74c180ae06e1","event_types":["advisory"],"published_at":"2026-10-24T23:59:48.463516+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-07T00:00:53.149+00:00","detail_url":"/events/11992"}]}},{"id":12019,"cve_ids":["CVE-2026-101331"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.","evidence":"cve:CVE-2026-101331","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-101331","aliases":["CVE-2026-101331"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-07T16:22:14.033Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101331","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T16:18:06.648613Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T16:22:14.033Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:58:32.179Z"}}},"related_cves":[{"value":"CVE-2026-101331","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ae254c22-a3d5-41a4-9aae-49125ef4f6a4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101331","advisory_id":"ae254c22-a3d5-41a4-9aae-49125ef4f6a4","event_types":["advisory"],"published_at":"2026-10-24T23:59:29.996417+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:58:32.179+00:00","detail_url":"/advisories/advisory%3Aae254c22-a3d5-41a4-9aae-49125ef4f6a4","group":{"id":"advisory:ae254c22-a3d5-41a4-9aae-49125ef4f6a4","revision":1,"primary_event_id":11964,"change":"published","superseded_by":[],"changed":{"id":11964,"cve_ids":["CVE-2026-101331"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.","evidence":"cve:CVE-2026-101331","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-101331","aliases":["CVE-2026-101331"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-07T16:22:14.033Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101331","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T16:18:06.648613Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T16:22:14.033Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:58:32.179Z"}}},"related_cves":[{"value":"CVE-2026-101331","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ae254c22-a3d5-41a4-9aae-49125ef4f6a4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101331","advisory_id":"ae254c22-a3d5-41a4-9aae-49125ef4f6a4","event_types":["advisory"],"published_at":"2026-10-24T23:59:29.996417+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:58:32.179+00:00","detail_url":"/events/11964"},"members":[{"id":11964,"cve_ids":["CVE-2026-101331"],"payload":{"kind":"advisory","title":"Langflow OSS is affected by multiple vulnerabilities","summary":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.","evidence":"cve:CVE-2026-101331","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-101331","aliases":["CVE-2026-101331"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.12.2"}]}],"modified":"2026-10-07T16:22:14.033Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7290694"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101331","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T16:18:06.648613Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T16:22:14.033Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-10-06T23:58:32.179Z"}}},"related_cves":[{"value":"CVE-2026-101331","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ae254c22-a3d5-41a4-9aae-49125ef4f6a4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101331","advisory_id":"ae254c22-a3d5-41a4-9aae-49125ef4f6a4","event_types":["advisory"],"published_at":"2026-10-24T23:59:29.996417+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T23:58:32.179+00:00","detail_url":"/events/11964"}]}},{"id":3300,"cve_ids":["CVE-2026-19304"],"payload":{"kind":"advisory","title":"Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components","summary":"IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.","evidence":"cve:CVE-2026-19304","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-19304","aliases":["CVE-2026-19304"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.11.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.11.2"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T19:07:57.581Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7285639"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19304","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-08T17:14:42.581676Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-08T17:14:54.503Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-09-28T19:07:57.581Z"}}},"related_cves":[{"value":"CVE-2026-19304","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3c961973-8b01-4e1b-b5c4-410533a668a2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19304","advisory_id":"3c961973-8b01-4e1b-b5c4-410533a668a2","event_types":["advisory"],"published_at":"2026-10-24T21:33:27.9217+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T15:30:25.425+00:00","detail_url":"/advisories/advisory%3A3c961973-8b01-4e1b-b5c4-410533a668a2","group":{"id":"advisory:3c961973-8b01-4e1b-b5c4-410533a668a2","revision":1,"primary_event_id":3313,"change":"published","superseded_by":[],"changed":{"id":3313,"cve_ids":["CVE-2026-19304"],"payload":{"kind":"advisory","title":"Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components","summary":"IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.","evidence":"cve:CVE-2026-19304","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-19304","aliases":["CVE-2026-19304"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.11.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.11.2"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T19:07:57.581Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7285639"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19304","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-08T17:14:42.581676Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-08T17:14:54.503Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-09-28T19:07:57.581Z"}}},"related_cves":[{"value":"CVE-2026-19304","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3c961973-8b01-4e1b-b5c4-410533a668a2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19304","advisory_id":"3c961973-8b01-4e1b-b5c4-410533a668a2","event_types":["advisory"],"published_at":"2026-10-24T21:33:27.9217+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T15:30:25.425+00:00","detail_url":"/events/3313"},"members":[{"id":3313,"cve_ids":["CVE-2026-19304"],"payload":{"kind":"advisory","title":"Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components","summary":"IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.","evidence":"cve:CVE-2026-19304","products":[{"name":{"value":"Langflow OSS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-19304","aliases":["CVE-2026-19304"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.11.2:*:*:*:*:*:*:*"],"vendor":"IBM","product":"Langflow OSS","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThanOrEqual":"1.11.2"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T19:07:57.581Z","provider":"cve","references":["https://www.ibm.com/support/pages/node/7285639"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19304","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-08T17:14:42.581676Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-08T17:14:54.503Z"}}],"cna":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-09-28T19:07:57.581Z"}}},"related_cves":[{"value":"CVE-2026-19304","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3c961973-8b01-4e1b-b5c4-410533a668a2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19304","advisory_id":"3c961973-8b01-4e1b-b5c4-410533a668a2","event_types":["advisory"],"published_at":"2026-10-24T21:33:27.9217+00:00","technologies":["core-cve","langflow-oss"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T15:30:25.425+00:00","detail_url":"/events/3313"}]}}],"next_after":45487,"next_before":3300}