IBM Langflow OSS versions 1.0.0 through 1.12.8 contain a critical vulnerability (CWE-94) that allows remote attackers to execute arbitrary code due to improper control over code generation. This flaw enables attackers to fully compromise affected systems without requiring user interaction or privileges.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a directory traversal vulnerability (CWE-22) that allows an authenticated user to access arbitrary files on the system by sending a specially crafted URL request. This vulnerability can lead to unauthorized disclosure of sensitive information. The CVSS score is 6.5, indicating a medium severity impact primarily affecting confidentiality.
CVE-2026-110192 affects IBM Langflow OSS versions 1.0.0 through 1.12.8 and involves insufficient protection of credentials. This vulnerability allows a remote authenticated attacker to access sensitive information due to weak credential protection mechanisms. The vulnerability has a CVSS score of 6.5, indicating a medium severity level, with a high impact on confidentiality but no impact on integrity or availability.
IBM Langflow OSS versions 1.0.0 through 1.12.8 contain a vulnerability that allows a remote attacker with low-privileged authenticated access to cause the Agentic Assistant to generate or submit component code with unblocked patterns. This can lead to arbitrary operating system command execution on the server.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a missing authorization vulnerability (CWE-862) that allows a remote attacker with low-privileged authenticated access to bypass administrator-only restrictions and execute arbitrary code on the server by manipulating a built-in code-execution component.
IBM Langflow OSS versions 1.0.0 through 1.12.4 store sensitive information in cleartext, which could allow a remote authenticated attacker to access this information. The vulnerability is identified as CWE-312 and has a medium severity with a CVSS score of 6.5. No public exploits or patches are currently documented.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability (CWE-22) that allows a remote authenticated attacker to access sensitive information by bypassing pathname restrictions to a protected directory. This flaw could lead to full confidentiality, integrity, and availability compromise of the affected system.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain an improper authentication vulnerability that could allow a remote attacker to obtain sensitive information without authorization. This vulnerability does not require user interaction or privileges to exploit and impacts confidentiality.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability (CWE-94) that allows a remote authenticated attacker to execute arbitrary commands due to improper control of code generation. This vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.
CVE-2026-96199 is a heap-based buffer overflow vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. Microsoft has released an official fix in version 154.0.4258.37 to address this issue.
CVE-2026-96198 is a heap-based buffer overflow vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. Microsoft has released an official fix in version 154.0.4258.37 to address this issue.
CVE-2026-85897 is a heap-based buffer overflow vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. Microsoft has released an official fix in version 154.0.4258.37 to address this issue. The vulnerability has a high severity rating with a CVSS score of 8.8. No known exploits are reported in the wild at this time.
CVE-2026-85890 is a high-severity double free vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. An official fix is available in version 154.0.4258.37.
CVE-2026-106036 is a vulnerability in Krajowa Izba Rozliczeniowa's Szafir application where it improperly validates SSL/TLS certificates. The application accepts any client or server certificate without verifying the certificate or hostname, allowing HTTPS connections without authenticating the remote server. This flaw enables an attacker to present an arbitrary SSL/TLS certificate and potentially cause the application to download malicious update files from an attacker-controlled server. The issue was fixed in Szafir version 2.0 build 708.
Szafir, a product by Krajowa Izba Rozliczeniowa, has a path traversal vulnerability in the handling of uploaded filenames. An attacker capable of intercepting and redirecting update requests can craft an arbitrary XML file that the system saves to a location chosen by the attacker. This vulnerability is identified as CWE-22 and was fixed in version 2.0 build 708. The CVSS 4.0 score is low (2.3), reflecting limited impact and attack complexity.
Szafir and Szafir Weryfikująca products from Krajowa Izba Rozliczeniowa are affected by an XML External Entity (XXE) vulnerability (CWE-611). This flaw allows an attacker to craft XML files with external DTD references that, when processed by the vulnerable XML parser during signing or verification, can lead to arbitrary file disclosure from the victim's filesystem. The vulnerability has been fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported and remains vulnerable.
CVE-2026-42694 is a medium-severity vulnerability in Themeum Kirki up to version 6.4.0 that allows improper neutralization of script-related HTML tags, leading to basic cross-site scripting (XSS). This flaw enables code injection via crafted input. The issue is fixed in version 6.4.1.
CVE-2026-48200 is a vulnerability in Barn2 Plugins Document Library Lite (versions before 1.3.1) that allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data. The issue affects versions up to 1.3.0 and has a medium severity with a CVSS score of 5.3.
CVE-2026-116848 is a stored cross-site scripting (XSS) vulnerability in The Plus Addons for Elementor Page Builder Lite by POSIMYTH Innovations. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. Versions from initial release up to 6.5.3 are affected. The issue is fixed in version 6.6.0.
CVE-2026-109891 is a missing authorization vulnerability in the Happy Addons for Elementor plugin by weDevs. It affects versions from the initial release up to 3.50.1. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized access. The issue has been fixed in version 3.51.0.