https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 02:20:06 +0000 https://cve.radiocsirt.org/vuln/cve-2026-48519 <p><strong>Affected:</strong> langflow-ai langflow</p> <p>Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the &#34;Shareable Playground&#34; (or &#34;Public Flows&#34; in code) contains a critical RCE vulnerability. Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link. Specifically, it enables the route /api/v1/build_public_tmp to execute any public flow, given a public flow ID. When the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload. The vulnerable field is data.nodes[X].data.node.template.code.value. This vulnerability is fixed in 1.9.2.</p> <p><strong>Affected:</strong> langflow-ai langflow</p> <p>Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the &#34;Shareable Playground&#34; (or &#34;Public Flows&#34; in code) contains a critical RCE vulnerability. Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link. Specifically, it enables the route /api/v1/build_public_tmp to execute any public flow, given a public flow ID. When the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload. The vulnerable field is data.nodes[X].data.node.template.code.value. This vulnerability is fixed in 1.9.2.</p> https://cve.radiocsirt.org/vuln/cve-2026-48519