Threat database

Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker could exploit this flaw to send unauthorized requests from the affected system, potentially enabling network enumeration or other attacks. The vulnerability has a medium severity rating with a CVSS score of 5.4. No public exploits or patches are currently documented.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability (CWE-78) that allows a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements in OS commands. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a critical vulnerability due to missing authorization controls. This flaw allows a remote authenticated attacker to execute arbitrary code, impacting confidentiality, integrity, and availability of the affected system.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a critical vulnerability (CWE-94) that allows a remote authenticated attacker to execute arbitrary code due to improper control of code generation. This vulnerability has a CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

IBM Langflow OSS versions 1.0.0 through 1.12.8 contain a critical vulnerability (CWE-94) that allows remote attackers to execute arbitrary code due to improper control over code generation. This flaw enables attackers to fully compromise affected systems without requiring user interaction or privileges.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system.

CVE-2026-110192 affects IBM Langflow OSS versions 1.0.0 through 1.12.8 and involves insufficient protection of credentials. This vulnerability allows a remote authenticated attacker to access sensitive information due to weak credential protection mechanisms. The vulnerability has a CVSS score of 6.5, indicating a medium severity level, with a high impact on confidentiality but no impact on integrity or availability.

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a missing authorization vulnerability (CWE-862) that allows a remote attacker with low-privileged authenticated access to bypass administrator-only restrictions and execute arbitrary code on the server by manipulating a built-in code-execution component.

IBM Langflow OSS versions 1.0.0 through 1.12.4 store sensitive information in cleartext, which could allow a remote authenticated attacker to access this information. The vulnerability is identified as CWE-312 and has a medium severity with a CVSS score of 6.5. No public exploits or patches are currently documented.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain an improper authentication vulnerability that could allow a remote attacker to obtain sensitive information without authorization. This vulnerability does not require user interaction or privileges to exploit and impacts confidentiality.

The npm package @jasperquinn/postcss-motion-helpers contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be considered exposed and require immediate rotation from a different, uncompromised machine. Removing the package alone may not eliminate the malicious presence, as the attacker may have established persistent control.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.

CVE-2026-96199 is a heap-based buffer overflow vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. Microsoft has released an official fix in version 154.0.4258.37 to address this issue.

CVE-2026-96198 is a heap-based buffer overflow vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. Microsoft has released an official fix in version 154.0.4258.37 to address this issue.