https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T16:07:16.938621+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-277822 EUVD-2026-277822 2026-10-04T16:07:16.941298+00:00 EUVD-2026-277822 https://cve.radiocsirt.org/vuln/fkie_cve-2026-5026 fkie_cve-2026-5026 2026-10-04T16:07:16.941330+00:00

The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves SVG files with the 'image/svg+xml' content type without sanitizing their content.

Since SVG files can contain embedded JavaScript, an attacker can upload a malicious SVG that executes arbitrary JavaScript when viewed by other users, leading to stored cross-site scripting (XSS). This allows stealing authentication tokens stored in cookies, including JWT access and refresh tokens.

 https://cve.radiocsirt.org/vuln/ghsa-89f7-r7x8-83q7 GHSA-89f7-r7x8-83q7 2026-10-04T16:07:16.941365+00:00

The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves SVG files with the 'image/svg+xml' content type without sanitizing their content.

Since SVG files can contain embedded JavaScript, an attacker can upload a malicious SVG that executes arbitrary JavaScript when viewed by other users, leading to stored cross-site scripting (XSS). This allows stealing authentication tokens stored in cookies, including JWT access and refresh tokens.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0900 WID-SEC-W-2026-0900 — Langflow: Mehrere Schwachstellen 2026-10-04T16:07:16.941385+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Langflow ausnutzen, um Informationen offenzulegen, Daten zu manipulieren und Cross-Site-Scripting-Angriffe durchzuführen.