Veille CVE

Semaine du 24 août au 30 août 2026

8 CVE

Critique 2 Élevée 4 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « IBM Langflow OSS » ✕
  1. CVE-2026-19295 9.9 Critique

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control.

  2. CVE-2026-19294 6.5 Moyenne

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization.

  3. CVE-2026-19286 9.8 Critique

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

  4. CVE-2026-18904 8.2 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.

  5. CVE-2026-18899 7.5 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.

  6. CVE-2026-18891 8.2 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.

  7. CVE-2026-18729 8.8 Élevée

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

  8. CVE-2026-18545 4.3 Moyenne

    IBM Langflow OSS · Langflow langflow

    IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.