Threat database

CVE-2026-85330 is an incorrect authorization vulnerability in Microsoft Edge (Chromium-based) for Android. It allows an unauthorized attacker to bypass a security feature over a network. The issue affects versions from 1.0.0.0 up to but not including 155.0.4283.45. Microsoft has released an official fix in version 155.0.4283.45. The vulnerability has a medium severity rating with a CVSS score of 4.3.

CVE-2026-88090 is a medium severity vulnerability in Microsoft Edge (Chromium-based) involving type confusion (CWE-843). It allows an unauthorized attacker to elevate privileges remotely by accessing resources using incompatible types. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. Microsoft has issued an official fix in version 154.0.4258.37.

CVE-2026-114148 is a vulnerability in Microsoft .NET 10.0 installed on Linux where incorrect default permissions in ASP.NET Core allow an authorized local attacker to elevate privileges. The flaw affects multiple versions of .NET 8.0, 9.0, 10.0, and 11.0 preview releases prior to their respective fixed versions. The vulnerability has a high severity with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.

CVE-2026-20942 is a medium-severity vulnerability in Microsoft Edge (Chromium-based) involving improper restriction of rendered UI layers or frames. This flaw allows an unauthorized attacker to perform spoofing attacks over a network. The vulnerability affects versions from 1.0.0.0 up to but not including 156.0.4314.42. An official fix is available in version 156.0.4314.42.

CVE-2026-96203 is a use-after-free vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to elevate privileges over a network. The vulnerability affects versions from 1.0.0.0 up to but not including 155.0.4283.45. Microsoft has released an official fix in version 155.0.4283.45 to address this issue. The vulnerability has a high severity score of 8.8 and requires user interaction for exploitation.

CVE-2026-96192 is a use-after-free vulnerability in Microsoft Edge (Chromium-based) for iOS that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 155.0.4283.45. Microsoft has released an official fix in version 155.0.4283.45 to address this high-severity issue.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability where a remote authenticated attacker can obtain sensitive information due to improper sanitization of secrets during flow and project exports. This exposure of sensitive data does not affect integrity or availability but impacts confidentiality.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability where a remote authenticated attacker can overwrite arbitrary files due to improper limitation of pathnames to restricted directories. This flaw allows unauthorized file modification but does not impact confidentiality or availability directly. The vulnerability has a medium severity rating with a CVSS score of 6.5.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling.

IBM Langflow OSS versions 1.0.0 through 1.12.8 contain an improper authentication vulnerability (CWE-287) that allows remote attackers to bypass security restrictions. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is rated critical with a CVSS score of 9.8.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability is identified as CWE-918 and has a medium severity rating with a CVSS score of 5.0. No public exploits or patches are currently documented.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This is due to improper neutralization of special elements used in code generation, classified as CWE-94. The vulnerability has a high severity with a CVSS score of 8.8.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability (CWE-78) where improper neutralization of special elements in OS commands can allow a remote authenticated attacker to cause a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability. The CVSS score is 4.3 (medium severity).

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability and requires authentication to exploit.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability where an authenticated attacker can create a server-generated ZIP archive with paths that traverse outside the intended extraction directory. If a victim extracts this archive using a tool that does not sanitize paths, it could lead to arbitrary file writes on the victim's system.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with a read or share grant on a target flow to retrieve the flow owner's stored third-party credentials in cleartext from the API response.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker could exploit this flaw to send unauthorized requests from the affected system, potentially enabling network enumeration or aiding other attacks. The vulnerability has a medium severity rating with a CVSS score of 4.3. No public exploits or patches are currently documented.