Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 19:14:33 +0000 CVE-2026-12940 — Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoin… https://cve.radiocsirt.org/vuln/cve-2026-12940 <p><strong>Affected:</strong> IBM Langflow OSS</p> <p>IBM Langflow OSS 1.0.0 through 1.10.1  are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUS_ENV_VARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS4 environment variables.</p> <p><strong>Affected:</strong> IBM Langflow OSS</p> <p>IBM Langflow OSS 1.0.0 through 1.10.1  are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUS_ENV_VARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS4 environment variables.</p> https://cve.radiocsirt.org/vuln/cve-2026-12940