Threat Intelligence Database

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a remote authenticated attacker to bypass security restrictions due to incorrect authorization.

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container.

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the dangerous callable blocklist due to the logic error. If the crafted component reached the runtime execution path, the attacker could cause arbitrary operating system commands to execute on the server in-process, with the privileges of the running service.

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner.

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on attacker-controlled input.

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7 contain a critical vulnerability due to the use of default credentials. This flaw allows remote attackers to gain administrative access without authentication. The vulnerability has a CVSS score of 9.8, indicating a high severity with full confidentiality, integrity, and availability impact.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbox. This requires an affected Lua script/rule to be loaded. Excessive flow variables being registered may also cause Suricata to crash. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain an OS command injection vulnerability. This flaw allows a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration. The vulnerability has a high severity with a CVSS score of 8.8.

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows a remote authenticated attacker to exploit improper validation of user-controlled API endpoints to obtain sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5. No official patch or remediation details are provided in the available data.

CVE-2026-79724 is a critical OS command injection vulnerability in IBM Langflow OSS versions 1.0.0 through 1.11.5. It allows remote attackers to execute arbitrary operating system commands due to improper neutralization of special elements in OS commands.