https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 16:03:16 +0000 https://cve.radiocsirt.org/vuln/cve-2026-33760 <p><strong>Affected:</strong> langflow-ai langflow</p> <p>Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow&#39;s /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources — messages, sessions, build artifacts, and LLM transaction logs — without verifying that the authenticated requester owns the targeted resource. Any authenticated user can read, modify, rename, or permanently delete another user&#39;s data by supplying the target&#39;s resource ID or flow_id. This is a classic IDOR/BOLA vulnerability. Notably, the same source file (monitor.py) contains one correctly-implemented endpoint that uses an ownership check, demonstrating the correct pattern was known but inconsistently applied. This vulnerability is fixed in 1.9.0.</p> <p><strong>Affected:</strong> langflow-ai langflow</p> <p>Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow&#39;s /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources — messages, sessions, build artifacts, and LLM transaction logs — without verifying that the authenticated requester owns the targeted resource. Any authenticated user can read, modify, rename, or permanently delete another user&#39;s data by supplying the target&#39;s resource ID or flow_id. This is a classic IDOR/BOLA vulnerability. Notably, the same source file (monitor.py) contains one correctly-implemented endpoint that uses an ownership check, demonstrating the correct pattern was known but inconsistently applied. This vulnerability is fixed in 1.9.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-33760