https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:02:02.836630+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-380326 EUVD-2026-380326 2026-10-02T22:02:02.838822+00:00 EUVD-2026-380326 https://cve.radiocsirt.org/vuln/fkie_cve-2026-101861 fkie_cve-2026-101861 2026-10-02T22:02:02.838852+00:00

Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval() vulnerability in schema.py that allows authenticated attackers to achieve code execution by placing a Python object with a malicious __repr__ method into component input options lists. The eval() sink is triggered when a component is converted into a LangChain tool via ComponentToolkit.get_tools(), including during custom component saves through the API, by interpolating options into a Literal type string that is passed directly to eval() without safe evaluation controls.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3616 WID-SEC-W-2026-3616 — Langflow: Mehrere Schwachstellen 2026-10-02T22:02:02.838884+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Langflow ausnutzen, um Superuser-Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen sowie Daten offenzulegen oder zu manipulieren.