Apple macOS

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory.

Published: 2026-09-04T16:04:06.047Z
Updated: 2026-09-10T21:00:34.955Z

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.

Published: 2026-07-14T19:40:15.949Z
Updated: 2026-09-17T22:32:09.851Z

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system.

Published: 2026-09-04T16:29:57.010Z
Updated: 2026-09-10T21:00:34.502Z

IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attacker‑controlled input without sufficient sanitization when handling requests to the /api/v1/run/{flow_id} endpoint. An attacker with low‑privileged authenticated access (such as a valid API key or user session) can supply crafted path values, including absolute paths or path traversal sequences, allowing arbitrary file writes to locations writable by the Langflow process. Successful exploitation may lead to unauthorized file creation or modification, potentially resulting in further compromise depending on the deployment environment.

Published: 2026-09-04T14:27:27.568Z
Updated: 2026-09-10T21:00:35.612Z

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

Published: 2026-06-09T17:13:23.430Z
Updated: 2026-08-27T22:37:00.285Z