https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T05:03:12.008344+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-48520 CVE-2026-48520 — Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read 2026-10-06T05:03:12.027917+00:00

Affected: langflow-ai langflow

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the "Shareable Playground" (or "Public Flows" in code) contains a potential arbitrary file-read vulnerability, depending on the exact flow configuration used. By making a flow public, public execution of the flow is allowed. The execution request can contain a list of files that gets read by Langflow and fed into the LLM. The files path can be any path supported by the storage - it can be either a local file or S3 path if supported by the local configuration This vulnerability is fixed in 1.10.0.