IBM
Monthly
Remote code injection in IBM Langflow OSS 1.0.0 through 1.10.3 allows an authenticated remote attacker to execute arbitrary code on the underlying server by supplying malicious input through user-controlled code fields within the platform. The CVSS vector (AV:N/AC:L/PR:L) confirms the attack is network-reachable at low complexity, requiring only low-privilege credentials, with full confidentiality, integrity, and availability impact on the host. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal in IBM Langflow OSS versions 1.0.0 through 1.10.3 enables authenticated remote attackers to read arbitrary files on the underlying system by submitting URLs containing dot-dot sequences (/../). The CVSS scope change metric (S:C) confirms that exploitation reaches beyond the application's own directory boundary, exposing system-level files such as credentials, configuration, or private keys to any low-privileged account holder. No public exploit code has been identified at time of analysis, though IBM has released a patch via advisory node/7282647.
Cross-user chat history disclosure in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to read other users' conversation history by exploiting session_id collision in the MemoryComponent. The MemoryComponent.retrieve_messages and store_message methods validate only session_id when filtering records, omitting flow_id and user_id ownership checks, which exposes multiple REST API endpoints to unauthorized cross-user data access. No public exploit has been identified at time of analysis, but the straightforward exploitation path and High confidentiality impact make this a genuine remediation priority for any multi-user Langflow deployment.
Broken access control in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to inject arbitrary graph data into the shared execution cache for flows they do not own, via the deprecated POST /api/v1/build/{flow_id}/vertices endpoint. The endpoint performs no ownership validation, enabling cross-user cache pollution that can corrupt other users' workflow state, trigger unauthorized execution of foreign flows, or produce denial of service across a shared platform instance. No public exploit code exists and CISA KEV does not list this vulnerability; EPSS (0.20%, 10th percentile) and SSVC (exploitation: none, automatable: no) collectively indicate low immediate exploitation risk despite the high CVSS score.
Predictable Fernet encryption keys in IBM Langflow OSS 1.0.0 through 1.10.3 allow attackers to decrypt stored API keys and authentication tokens, because when a user secret is shorter than 32 characters the platform derives keys with Python's non-cryptographic `random` (Mersenne Twister) module. Because the Mersenne Twister PRNG is deterministic, identical seeds reproduce identical keys, so an adversary who can reconstruct the seeding conditions can regenerate the key and read every secret Langflow encrypted with it. No public exploit identified at time of analysis; EPSS is low (0.11%) and CISA SSVC records no known exploitation.
Predictable Fernet encryption key generation in IBM Langflow OSS (versions 1.0.0 through 1.10.3) stems from the ensure_fernet_key() function deriving keys from a cryptographically weak source (CWE-338), letting an attacker reconstruct the symmetric key that protects stored secrets such as API keys, credentials, and connection variables. Because the key is guessable rather than random, an actor who can read Langflow's encrypted data store can decrypt it and, depending on how the key is reused, potentially forge or tamper with protected values. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), but IBM rates the flaw CVSS 9.8 and a vendor patch is available.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.10.3 enables authenticated low-privilege users to coerce the application server into issuing arbitrary outbound HTTP requests against internal infrastructure. The root cause is unsanitized pass-through of the OLLAMA_BASE_URL parameter directly into requests.get() inside validate_model_provider_key(), with no scheme enforcement, host allowlisting, or private-range (loopback, RFC1918, link-local) filtering. No active exploitation confirmed (not in CISA KEV), but the network-accessible, low-complexity attack path and high confidentiality impact (C:H) make this a meaningful internal-network pivot risk for organizations running Langflow with AI provider integration enabled.
OS command injection in IBM Langflow OSS 1.0.0 through 1.10.3 enables remote authenticated attackers to execute arbitrary system commands on the underlying server. The flaw stems from insufficient sanitization of user-supplied input passed to OS-level command execution routines (CWE-78), granting full system-level access with a single authenticated request. No public exploit code has been identified at time of analysis, and CISA does not list this in KEV, though CVSS-assessed technical impact is total across confidentiality, integrity, and availability.
Arbitrary OS command execution in IBM Langflow OSS 1.0.0 through 1.10.3 is reachable by any authenticated low-privileged user who can modify MCP server configurations. Improper validation of the command field in those configurations allows injected shell commands to be executed with the application's process privileges, yielding full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible attack path against a growing AI-tooling platform warrants prompt patching.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated remote attackers to run arbitrary commands by supplying crafted configuration parameters that bypass the application's incomplete input denylist (CWE-184). The flaw carries a CVSS 8.8 score with full confidentiality, integrity, and availability impact, and SSVC rates the technical impact as total. No active exploitation is confirmed - EPSS sits at 0.42% (35th percentile) and the vulnerability is absent from CISA KEV - though the low attack complexity makes it a genuine priority for any internet-exposed Langflow deployment with untrusted authenticated users.
Host filesystem read and write access in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by any authenticated low-privilege user via insufficient filtering of Docker volume-mount and device-mapping arguments passed to Docker-based MCP servers. By injecting unsanitized flags such as --volume into MCP server configuration, an attacker can bind-mount arbitrary host directories into a spawned container, exposing or tampering with sensitive files outside the intended Docker isolation boundary. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the network-exploitable, low-complexity attack path and full CIA impact score (CVSS 8.8) make this a high-priority patch target for any organization running Langflow in Docker environments with externally accessible or multi-tenant access.
Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.3 exposes the Model Context Protocol (MCP) composer endpoint to unauthenticated remote access when projects are configured with auth_type=oauth and MCP composer is enabled - which is the default deployment state. An unauthenticated network attacker can reach the MCP composer endpoint and read confidential project data (C:H) without supplying valid credentials, entirely bypassing the OAuth authentication gate. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor (IBM) has confirmed the issue and released a patch.
Remote authenticated attackers can bypass localhost-only access restrictions in IBM Langflow OSS 1.0.0 through 1.10.3 to write arbitrary MCP (Model Context Protocol) server configurations to IDE configuration files on the underlying host system. The CVSS scope change (S:C) confirms this escapes the Langflow application boundary, enabling persistent manipulation of developer IDE environments on the host. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Server-Side Request Forgery in IBM Application Gateway Operator versions 22.2 through 26.06 lets remote unauthenticated attackers coerce the operator into issuing arbitrary HTTP requests by supplying attacker-controlled URLs in custom resources that the operator fails to validate. Because the operator typically runs inside a Kubernetes/OpenShift cluster, this SSRF can reach internal-only services and cloud metadata endpoints. There is no public exploit identified at time of analysis, EPSS risk is low (0.29%, 21st percentile), and CISA SSVC rates exploitation as none.
XML External Entity injection in IBM QRadar SIEM (versions 7.5.0 through 7.5.0 UP 15 IF005 and 7.6.0.0 through 7.6.0.1) lets remote unauthenticated attackers submit crafted XML-formatted syslog events to the parseXmlPayload() function in the event-processing pipeline. When any log source type uses XML-format property autodetection, events arriving on port 514 (UDP/TCP) are parsed without authentication, enabling file disclosure, SSRF, and denial of service. No public exploit identified at time of analysis, but EPSS is a low 0.32% (25th percentile) and IBM has published a fix.
Command injection in IBM QRadar SIEM allows an authenticated privileged user to execute arbitrary OS commands at normal user privilege level due to insufficient input validation (CWE-78). Affected versions span QRadar 7.5.0 through 7.5.0 UP 15 Interim Fix 005 and 7.6.0.0 through 7.6.0.1, placing enterprise security operations centers at risk if SIEM operator accounts are compromised or misused by insiders. No public exploit code exists and no active exploitation is confirmed; EPSS places this at the 13th percentile (0.22%), indicating minimal near-term mass-exploitation probability.
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Liberty Continuous Delivery allows a malicious or attacker-controlled IIOP server to force a WebSphere client/server to load and instantiate arbitrary Java classes over the network. Exploitation requires no authentication or user interaction (CVSS 9.8), and successful abuse can lead to loss of confidentiality, integrity, and availability, potentially culminating in remote code execution via dangerous class instantiation. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.44% probability of exploitation in the next 30 days.
Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 allows an authenticated attacker to run arbitrary code by delivering a malicious serialized Java object through the SOAP/JMX connector, which the server deserializes unsafely (CWE-502). An attacker with low-level credentials who can reach the management connector can achieve full compromise of the application server process. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execute arbitrary code on the underlying host by supplying malicious user-controlled code that is improperly validated (CWE-94). Because Langflow evaluates user-supplied code as part of its low-code AI/agent flow-building functionality, exploitation grants full compromise of the server hosting the application. There is no public exploit identified at time of analysis, but the CVSS 3.1 base score of 9.9 with a scope change reflects that a successful attack can break out of the application context to affect other system components.
Cross-tenant vector document disclosure in IBM Langflow OSS 1.0.0 through 1.10.1 lets an authenticated low-privilege user read another user's private Chroma-backed documents by building a flow that reuses the victim's persist_directory and collection_name, returning exact victim content in the attacker's workflow output. The same shared-namespace flaw also lets the attacker write their own documents into the victim's collection, corrupting its integrity. No public exploit is identified at time of analysis and CISA SSVC rates exploitation as none, but the CVSS 8.1 rating reflects the combined high confidentiality and integrity impact.
Open redirect in IBM Planning Analytics Local versions 2.1.0 through 2.1.21 lets remote attackers craft URLs that bounce authenticated users to attacker-controlled external sites. When the product is deployed with SSO authentication, the redirect can leak session tokens carried in the flow, enabling session hijacking. No public exploit identified at time of analysis; this is not on CISA KEV and no POC is referenced in the provided data.
OS command injection in the IBM Hardware Management Console (HMC) lets a remote, unauthenticated attacker run arbitrary commands with elevated privileges on the management appliance. It affects HMC V10.3.1050.0 through 10.3.1064.0 and V11.1.1110.0 through 11.1.1112.0, the systems used to manage IBM Power servers (including Novalink deployments), stemming from improper validation of user-supplied input (CWE-78). No public exploit has been identified at time of analysis, but the network-reachable, no-authentication vector and 9.8 CVSS make this a top-priority patch.
Denial of service in IBM DataPower Gateway (versions 10.5.0, 10.6.0, 10.6cd, and 11.0.0) allows a remote unauthenticated attacker to exhaust system resources due to improper resource limitations (CWE-770), rendering the gateway unavailable. The CVSS 3.1 base score is 7.5 with an availability-only impact (A:H) and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a vendor patch is available.
Remote code execution in IBM webMethods Integration (on-prem) 10.15 and 10.11 allows an unauthenticated network attacker to run arbitrary code by submitting maliciously crafted serialized data that the platform deserializes without validation (CWE-502). Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with full CIA impact (9.8 Critical), exploitation requires no credentials and no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the vendor (IBM) has released a patch, indicating a confirmed, fixable flaw.
Stack-based buffer overflow in IBM Db2's setgid helper binary db2flacc allows a local user with low privileges to overwrite the stack frame and execute arbitrary code with the elevated group permissions of the binary. Both Db2 11.5.x (through 11.5.9) and 12.1.x (through 12.1.4) are affected. No public exploit has been identified and exploitation status is confirmed as none per SSVC, though IBM has released a patch and the SSVC technical impact is rated total, warranting prompt remediation on shared-access Db2 hosts.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sandbox, allowing a low-privileged authenticated user to escape the sandbox and run arbitrary Python. Because the flaw carries a scope-changing CVSS 3.1 score of 9.9 (S:C, C/I/A all High), a successful exploit can compromise the underlying host beyond the intended sandbox boundary. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file read in IBM Langflow OSS versions 1.0.0 through 1.10.1 allows remote unauthenticated attackers to retrieve files outside the intended web root by submitting URLs containing directory-traversal ("../") sequences. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation needs no authentication or user interaction and can expose sensitive files such as configuration, secrets, or source code. No public exploit identified at time of analysis, and there is no indication of active exploitation.
Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.10.1 lets an authenticated low-privileged user read and tamper with build jobs belonging to other users by abusing improper access control on log-retrieval and unauthenticated build endpoints. Because Langflow orchestrates LLM/agent workflow builds, a cross-tenant attacker can view sensitive build logs (high confidentiality impact) and interfere with others' jobs (limited availability impact). A vendor patch is available; there is no public exploit identified at time of analysis and the flaw is not on CISA KEV.
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary OS commands by injecting shell-control environment variables into the MCP (Model Context Protocol) stdio launcher. The DANGEROUS_ENV_VARS blocklist in src/lfx/src/lfx/base/mcp/util.py omits SHELLOPTS, BASHOPTS, and PS4, letting an attacker abuse Bash's xtrace behavior to execute commands when a stdio-based MCP server subprocess is spawned. Rated CVSS 9.8 with a network, no-privilege, no-interaction vector; a vendor patch is available, but no public exploit code or CISA KEV listing has been identified at the time of analysis.
OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and FW1110 families) allows a low-privileged actor inside a logical partition to issue a carefully crafted hypervisor call that crashes the PowerVM hypervisor or corrupts OS memory. Because the flaw crosses the partition-to-hypervisor trust boundary (CVSS scope change), a single guest partition can impact the integrity and availability of the shared virtualization layer serving other partitions. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; IBM, the reporter, has released a fix.
Denial of service in IBM WebSphere Application Server (9.0, 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote unauthenticated attackers exhaust server resources by sending a single crafted HTTP request, forcing the application server to become unresponsive. The flaw (CWE-400, uncontrolled resource consumption) carries CVSS 7.5 with a full availability impact and requires no privileges or user interaction, making it trivially reachable on any exposed HTTP listener. There is no public exploit identified at time of analysis, but a vendor patch is available from IBM.
Security constraint bypass in IBM WebSphere Application Server 8.5/9.0 (Traditional) and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7 allows a remote, unauthenticated attacker to circumvent access controls and reach protected resources, resulting in disclosure of confidential information (CVSS 3.1 base 7.5, C:H). The flaw stems from an authentication-bypass-by-alternate-name weakness (CWE-289) in how the server evaluates security constraints. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Uncontrolled memory consumption in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.7) lets a remote attacker crash or degrade the server by sending a single specially crafted request that forces excessive memory allocation. The flaw is network-reachable and requires no authentication or user interaction (PR:N/UI:N), and IBM (the reporter) has released a fix. There is no public exploit identified at time of analysis, and no EPSS or CISA KEV data was provided.
Local information disclosure in IBM App Connect Enterprise (versions 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27) occurs because the integration runtime writes potentially sensitive information into log files that any local user can read. An attacker with local access to the host can harvest secrets such as credentials, connection strings, or message payload data from these logs to escalate access or pivot to backend systems. No public exploit identified at time of analysis, and there is no KEV listing; note that the NVD CVSS vector (AV:N) conflicts with the description's explicit 'local user' wording.
Arbitrary code execution in the IBM Aspera Desktop App (versions 1.0.5 through 1.0.19) arises from insecure DLL loading at application start-up, allowing a local low-privileged attacker who can place a malicious DLL in a path the app searches to run code in the context of the launching user. IBM (the reporter and vendor) has published a fix, and there is no public exploit identified at time of analysis. Impact is high to confidentiality, integrity, and availability, but exploitation is gated by local access and the user launching the application.
Reflected cross-site scripting in the administrative console login page of IBM Tivoli System Automation Application Manager 4.1 (a component that also involves IBM WebSphere Application Server) allows a remote attacker to inject and execute arbitrary script in an administrator's browser session. The CVSS 3.1 vector (AV:N/PR:N/UI:R, scope-changed) yields a high 9.3 base score, but exploitation requires tricking an authenticated console user into loading a crafted URL. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Cross-site request forgery in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables server-side request forgery with elevated privileges when the collectiveController-1.0 feature is active. An attacker who lures an authenticated Liberty administrator to a malicious web page can trigger forged requests that the server executes with the victim's elevated privileges, allowing the attacker to reach internal services ordinarily inaccessible from the network perimeter. No public exploit code exists and no confirmed active exploitation is recorded, though the SSVC framework rates the technical impact as total should exploitation occur.
Directory traversal in IBM App Connect Enterprise 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27 lets a remote unauthenticated attacker write arbitrary files by sending a crafted URL containing '../' sequences. Because attacker-controlled file writes on an integration server can overwrite configuration, deployment artifacts, or executable content, this maps to a full-compromise CVSS 9.8. No public exploit identified at time of analysis, but the vendor (IBM) has released a fix.
Command injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2) lets a remote attacker execute arbitrary OS commands by injecting CRLF characters that break the intended neutralization of command input. Rated CVSS 9.8 (network, no authentication, no user interaction) with total confidentiality, integrity, and availability impact; a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS probability is modest at 0.50% (40th percentile).
Arbitrary file read in IBM App Connect Enterprise (versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27) allows a remote, unauthenticated attacker to retrieve files outside the intended directory via a path traversal flaw (CWE-22), scoring CVSS 7.5. The vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no privileges or user interaction, though impact is confined to confidentiality (C:H/I:N/A:N). There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low-complexity, no-auth profile makes it a straightforward disclosure risk once details are known.
Denial of service in IBM Enterprise Build of Quarkus (versions 3.27.1 through 3.27.4.SP2 and 3.33.1 through 3.33.2.SP2) allows a remote, unauthenticated attacker to exhaust memory by sending multipart requests whose MIME part-headers are accumulated without bound in the Quarkus REST layer. Because each part-header buffer grows without a size cap, an attacker can force excessive heap allocation and crash or hang the service, degrading availability for all users. There is no public exploit identified at time of analysis, but the flaw is trivially reachable (AV:N/AC:L/PR:N/UI:N) against any endpoint that accepts multipart input.
Cross-site request forgery in IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.8 enables remote attackers to execute unauthorized actions on behalf of authenticated users without their consent. The vulnerability exploits the server's implicit trust in session cookies, allowing a malicious third-party site to trigger state-changing requests against the Liberty instance. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch.
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.8) lets remote unauthenticated attackers coerce the server into issuing arbitrary requests when the SIP container feature (sipServlet-1.1) is enabled. The flaw carries a CVSS 9.8 rating with total technical impact, and IBM has released a fix (advisory node/7281721); no public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.33%.
Cross-user information disclosure in IBM Langflow OSS 1.0.0-1.10.1 allows authenticated attackers to access private vector content and poison query results by reusing another user's FAISS namespace. This leads to high confidentiality impact and low integrity impact; the vulnerability has a CVSS 3.1 score of 7.1, and a vendor patch is available.
Sensitive information disclosure in IBM Cloud Pak System 2.3.5.0 allows local attackers to obtain credentials from log files. The CVSS score is 7.5 with a network vector, but the description explicitly states local access, creating ambiguity. No public exploit or active exploitation has been identified at the time of analysis.
Unauthenticated administrative access in IBM WebSphere Application Server 9.0 and 8.5 due to broken access control allows remote attackers to gain full control of the server. The vulnerability resides in the administrative console and requires no credentials or user interaction, leading to complete confidentiality, integrity, and availability impact. No public exploit code is known, but a vendor patch is available to remediate this critical risk.
Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unauthenticated attackers to execute arbitrary code or bypass authentication. CVSS 9.8 indicates critical severity with low attack complexity and no user interaction, though no public exploit code or active exploitation has been identified at time of analysis.
Sensitive information disclosure in IBM WebSphere Application Server 8.5 and 9.0 Traditional allows a remote, unauthenticated attacker to obtain confidential data, assessed by IBM as a High-severity issue (CVSS 7.5). The root cause is CWE-532, indicating that sensitive information is inserted into log files or diagnostic output in a manner accessible to remote actors. No public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the CVSS vector attributes high confidentiality impact, and a vendor-released patch is available via IBM support.
Prototype pollution in the @instana/core Node.js tracer, part of IBM Observability with Instana Agent builds 1.0.303 to 1.0.320, allows a local attacker to inject arbitrary properties into JavaScript object prototypes. This can lead to information disclosure and high integrity impact. No public exploit or active exploitation reported; vendor patch is available.
Arbitrary OS command execution is possible in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) through unquoted shell interpolation, allowing a remote attacker who has already obtained high-privilege authentication to run arbitrary commands on the underlying host. The CVSS vector (AV:N/AC:L/PR:H) confirms network reachability with low attack complexity once authenticated, resulting in full confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via the advisory at https://www.ibm.com/support/pages/node/7280530.
Shell command injection in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) permits a remote attacker holding high-privilege credentials to execute arbitrary operating system commands on the underlying server. The CVSS 7.2 High score reflects full confidentiality, integrity, and availability impact, substantially gated by the PR:H authentication requirement. No public exploit has been identified at time of analysis, and both EPSS (1.04%, 60th percentile) and CISA SSVC (Exploitation: none) align on low current exploitation activity; a vendor patch is confirmed available.
Path traversal vulnerability in IBM Aspera Desktop App 1.0.5–1.0.19 allows remote attackers to write files outside the user’s intended download directory by enticing a user to interact with a malicious download request or file. No active exploitation or public exploit code has been identified at the time of analysis, and a vendor patch is available.
Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network attacker to run arbitrary code by sending crafted serialized data that the server deserializes without validation (CWE-502). The flaw carries a CVSS 9.8 rating with a network attack vector and no authentication or user interaction required, though SSVC records exploitation as none observed and no public exploit was identified at time of analysis. EPSS is low at 0.37% (29th percentile), indicating that active, widespread exploitation has not yet materialized despite the maximal technical impact.
Remote code execution in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows unauthenticated network attackers to execute arbitrary code when the collectiveController-1.0 feature is enabled. Rooted in a missing-authentication weakness (CWE-306) on collective controller management functions, the flaw carries a 9.8 CVSS score and total technical impact per CISA's SSVC framework. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), but the network-reachable, unauthenticated nature makes it a high-priority patch where the collective feature is in use.
Denial of service in IBM WebSphere Application Server 9.0, 8.5 and Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to consume server resources via malicious HTTP requests exploiting unbounded resource allocation. This can render the service unavailable. No active exploitation or public exploit has been identified.
Improper session expiration in IBM Aspera Faspex 5 allows remote unauthenticated attackers to access sensitive data. The vulnerability, tracked as CVE-2026-14996, affects versions 5.0.0 through 5.0.15.4 and stems from insufficient session invalidation (CWE-613). Attackers who obtain a valid session token can reuse it after the intended lifetime, compromising confidentiality of file transfer data with limited integrity impact.
Authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows a remote unauthenticated attacker to send a specially crafted request and reach protected resources without valid credentials, with CVSS rating full compromise of confidentiality, integrity, and availability. The flaw stems from missing authorization enforcement (CWE-862) and carries a CVSS 9.8 requiring no user interaction or privileges. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.31% (24th percentile) and CISA SSVC currently rates exploitation as 'none' with only partial technical impact.
Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to cause service disruption via uncontrolled heap allocation, resulting in high availability impact. No public exploit or active exploitation reported; vendor patch is available.
HTTP response smuggling in IBM WebSphere Application Server 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to poison intermediate caching proxies by exploiting improper handling of non-standard HTTP version tokens. Successful exploitation leads to high confidentiality and integrity impact through cache poisoning, potentially enabling information disclosure and malicious content injection into proxied responses. A vendor patch is available, though no public exploit code or active exploitation has been reported at this time.
Information disclosure in IBM WebSphere Liberty ND Collective Controller, versions 17.0.0.3 through 26.0.0.8, allows remote unauthenticated attackers to read arbitrary files via path-segment injection in the collective routing mechanism. Successful exploitation exposes sensitive configuration data without user interaction or authentication. No public exploit or active exploitation (CISA KEV) has been reported at this time.
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7 allows remote attackers to poison request queues, potentially leading to unauthorized information disclosure and cache poisoning. The flaw stems from improper handling of TRACE requests, with a CVSS base score of 8.7 but no evidence of active exploitation or public exploit code at the time of analysis.
HTTP request smuggling in IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) enables remote unauthenticated attackers to poison shared HTTP connections between a front-end proxy and the application server backend. The CVSS 8.1 score reflects full confidentiality, integrity, and availability impact (C:H/I:H/A:H) but is constrained by high attack complexity (AC:H), requiring a specific proxy-to-WAS pipeline configuration to exploit. No public exploit is identified at time of analysis; EPSS is very low at 0.21% (11th percentile) and SSVC confirms no known exploitation, though technical impact is rated total.
SQL injection in IBM Sterling B2B Integrator and File Gateway allows authenticated remote attackers to view, add, modify, or delete database contents. Affects versions 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. No public exploit or active exploitation (KEV) known at time of analysis.
Privilege escalation in IBM OpenBMC firmware allows any authenticated ReadOnly user to grant themselves full administrator access over the BMC interface on affected IBM Power Systems servers. The flaw spans two firmware release trains - FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 - across more than a dozen IBM Power9 and Power10 server models. No public exploit code or active exploitation has been identified; EPSS is 0.17% (7th percentile) and SSVC classifies exploitation as none, but the consequence of BMC administrator access is severe given the out-of-band control it provides over physical infrastructure.
We are tasked with synthesizing data from multiple sources about CVE-2026-64318 into a comprehensive analysis, returning a JSON object with specified fields. Let's carefully parse the provided information. CVE-2026-64318: In the Linux kernel, a vulnerability in the AIX partition handling. The description: "aix_partition() reads the physical volume descriptor... pp_count is unvalidated, so a crafted AIX image with pp_count > 1016 drives an out-of-bounds read... bound the scan to array size." From description: - Product: Linux kernel, specifically the partition handling for AIX disks (block/partitions/aix.c). So product_name: "Linux Kernel". - CVSS Score: 7.1, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - CWE: N/A - EPSS: 0.22% (percentile 13%) - Patch: Available from vendor - Tags: Linux, IBM, Information Disclosure - KEV status: not mentioned (likely not KEV). POC? Not mentioned. So no active exploitation or public exploit identified from data. - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (but note: Linux kernel is typically "o:linux:linux_kernel", but given as "a" application? The data says "cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*". We'll use it as is, but product_name Linux kernel is correct.) - Affected versions: We have a list of git commit ranges and patches. We can extract the fix versions: mention specific stable versions patched: 7.1.4, 6.18.39, 5.15.212, 5.10.261, 7.2-rc1, 6.6.145, 6.12.96, 6.1.178, and the initial commit from 3.11. So the vulnerability was introduced long ago (Linux 3.11) and fixed in multiple stable branches. The description mentions "Linux 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 < ..." which is the commit that fixed it? Possibly the fix commit. The EUVD entries give commit ranges where the vulnerability exists. We'll synthesize: Affected: Linux kernel versions from 3.11 up to before the fix in the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1, 7.2 series. So we can say "Linux kernel versions prior to the patched releases: 5.10.261, 5.1
Cross-user file access in IBM Langflow OSS (1.0.0 through 1.10.1) lets an authenticated user abuse the SaveToFile component to read and modify files uploaded by other users by supplying absolute paths that point into victim storage locations. Append mode enables exfiltration of victim data into the attacker's namespace (confidentiality), while overwrite mode allows replacing victim content with arbitrary data (integrity), collapsing the per-user storage ownership boundary. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.
Authentication bypass and full data compromise affects IBM Langflow OSS 1.0.0 through 1.10.1, which ships hard-coded credentials (a static password or cryptographic key) embedded in the application. Because the same secret is present in every deployment, remote attackers who read it from the public source or a binary can authenticate to inbound interfaces, impersonate the app to external components, or decrypt internal data on any affected instance. No public exploit identified at time of analysis, but the shared-secret nature makes exploitation trivial once the value is known.
Denial of service in IBM Engineering Lifecycle Management's DOORS component exposes unauthenticated remote attackers to crash or degrade the service by submitting XML payloads exploiting recursive entity expansion. Affected deployments span three active release branches - 7.0.3 through Interim Fix 021, 7.1.0 through Interim Fix 009, and 7.2.0 including Interim Fix 001. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.36% (28th percentile) confirms low current exploitation activity, but the unauthenticated network vector makes remediation advisable for internet-facing or low-trust-network deployments.
IBM PowerVM Novalink API misconfiguration (CWE-16) expands the attack surface and enables unauthorized virtualization management operations under non-default configurations. Versions 2.2.0 through 2.2.1.1 and 2.3.0 through 2.3.2 are confirmed affected via NVD CPE data, with a low-privileged local attacker potentially achieving full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and an EPSS score of 0.10% at the 1st percentile signals negligible exploitation activity - real-world risk is constrained by the non-default configuration prerequisite and local-only attack vector.
Remote code execution and information disclosure in IBM Db2 Genius Hub (1.1, 1.1.1, 1.1.2) and IBM Agentics 1.0 stem from the use of inherently dangerous functions invoked without sufficient input restrictions, allowing remote attackers to run arbitrary code or read sensitive data. IBM's PSIRT reported the flaw with a 9.8 critical CVSS reflecting network-reachable, unauthenticated exploitation with full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, and the low EPSS score (0.33%, 25th percentile) suggests exploitation is not yet widespread.
OS command injection in IBM Langflow OSS versions 1.0.0 through 1.10.1 lets an authenticated user run arbitrary system commands with elevated privileges by abusing improper input validation in the Python Interpreter component. Because the flaw sits in a feature that already executes user-supplied Python, any logged-in user can escalate to full host command execution (CVSS 8.8, CWE-78). No public exploit identified at time of analysis, though the low attack complexity and network vector make it high-priority for any exposed Langflow deployment.
Heap-based buffer overflow in IBM Storage Protect Client (versions 8.1.0.0-8.1.27.1 and 8.2.0.0-8.2.1.0) lets a remote attacker corrupt heap memory through improper bounds checking, potentially achieving arbitrary code execution or crashing the affected process. The flaw carries a CVSS 3.1 base score of 9.8, but no public exploit identified at time of analysis and the EPSS probability is low (0.46%, 37th percentile). Note that the affected component is the backup Client, while the description references crashing 'the server,' introducing ambiguity about the true exploitation path.
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.1 lets anonymous attackers run arbitrary code by abusing the public flow build endpoint (/api/v1/build_public_tmp/{flow_id}/flow). The CVSS 3.1 base score is 9.8 (network, low complexity, no privileges or user interaction). No public exploit is identified at time of analysis, and the EPSS probability is modest at 0.44% (36th percentile), indicating exploitation is technically trivial but not yet observed at scale.
Stored/reflected cross-site scripting in IBM Engineering AI Hub 1.0.0 through 1.2.0 lets a remote unauthenticated attacker inject arbitrary scripts into generated web pages that execute in a victim's authenticated browser session. Because the CVSS scope is marked changed (S:C), successful exploitation can impact resources beyond the vulnerable component - such as the user's session with adjacent applications. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Sensitive information disclosure in IBM Engineering AI Hub 1.0.0 through 1.2.0 allows remote attackers to harvest session tokens that the application places directly in URLs, enabling session hijacking and account takeover. IBM (the reporting vendor) has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. The CWE-598 root cause means tokens leak passively into browser history, referer headers, proxy and server access logs rather than requiring an active attack against the server.
TLS protocol downgrade in IBM i 7.3 through 7.6 enables remote attackers to force negotiation of TLS versions explicitly disabled in the server configuration, undermining the operator's security posture by exposing session traffic to potential decryption. The CVSS vector (AV:N/AC:H/PR:N) confirms this is network-exploitable without authentication but requires high attack complexity, consistent with a man-in-the-middle positioning requirement during the TLS handshake. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; a vendor patch is available per IBM advisory 7278992.
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user create a malicious flow that points to an attacker-controlled URL returning a crafted Content-Disposition header, causing the Langflow process to write attacker-supplied content to any filesystem path it can access. Because writes can land on startup scripts, keys, or configuration files, this path-traversal (CWE-22) flaw is a realistic route to full server compromise. IBM has released a fix; no public exploit identified at time of analysis and the CVE is not in CISA KEV.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated remote attacker to run arbitrary code because validation is not fully enforced on Model Context Protocol (MCP) server configuration files, permitting injection of attacker-controlled commands or server definitions. IBM has published a fix advisory (node/7278932). With CVSS 8.8 (PR:L), a low-privileged user of the Langflow instance can escalate to full code execution on the host; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file read in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated attacker traverse the filesystem to exfiltrate sensitive files - most critically the JWT signing key - and then forge valid authentication tokens to impersonate any user, including administrators. The path-traversal-to-account-takeover chain turns a low-privilege foothold into full application compromise. No public exploit identified at time of analysis, and the EPSS score is low (0.38%, 31st percentile), but a vendor patch is available and the impact is severe.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override arbitrary component parameters at runtime through the API, bypassing the parameter filtering logic in the apply_tweaks() function (CWE-94 code injection). Because a low-privileged authenticated account is sufficient and the impact is full compromise of confidentiality, integrity, and availability (CVSS 8.8), this maps to server-side code execution on the Langflow host. There is no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a malicious pickle payload that the AsyncDiskCache deserializes with unauthenticated pickle.loads(). Any actor able to influence cached data - via file system access, crafted workflow inputs, custom components, or API manipulation - gains full compromise at the privilege of the Langflow server process. Rated CVSS 9.9 and reported by IBM with a vendor patch available; no public exploit identified at time of analysis.
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Python — and therefore arbitrary OS commands — with the privileges of the Langflow server process. The flaw is a design failure in the POST /api/v1/validate/code endpoint, which passes user-supplied code straight into Python's exec() with no sandbox, validation, or privilege drop. Rated CVSS 9.9 by IBM; no public exploit identified at time of analysis, though the trivial exec()-based trigger makes exploitation straightforward once authenticated.
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 stems from broken webhook authentication that skips API key validation whenever WEBHOOK_AUTH_ENABLE is False - which is the shipped default. Any remote attacker who learns a flow's UUID can invoke that flow's webhook endpoint as though they were its owner, running arbitrary flow logic and reaching RCE. No public exploit identified at time of analysis, but the CVSS 9.8 rating and default-vulnerable configuration make this a high-priority patch.
Privilege escalation to remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated user to elevate their account to superuser by directly manipulating the underlying database, then execute arbitrary system commands and achieve full compromise of the host running the Langflow service. The flaw (CWE-94, code injection) carries a critical CVSS 9.9 with a scope change, meaning code runs with the Langflow service account's permissions beyond the vulnerable component. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a vendor patch is available.
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plant files at attacker-chosen paths on the Langflow host. The flaw lives in the APIRequest component's 'Save to File' feature, which trusts filenames from a response Content-Disposition header without sanitizing path traversal sequences, so a malicious server response can escape the temporary directory and write to any location the Langflow process can reach. No public exploit identified at time of analysis, and it is not in CISA KEV; a patch is available per IBM's advisory.
Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.0 lets an unauthenticated remote attacker retrieve a long-lived superuser bearer token from the /api/v1/login/auto_login endpoint whenever the AUTO_LOGIN setting is on - which is the default. Because the endpoint mints full-admin tokens with no credentials, any network-reachable attacker gains complete administrative control, and overly permissive CORS can leak those tokens to unintended origins. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenticated users with flow-creation privileges to bypass the allow_custom_components=false control via the Policies component's ToolGuard integration. Because validation only inspects the main component code and ignores dynamic CodeInput fields, attackers persist malicious Python in a flow that runs server-side when a guarded tool executes. No public exploit has been identified at time of analysis, but the flaw is IBM-confirmed with a vendor patch and carries a critical 9.9 CVSS due to cross-tenant escalation through the agentic MCP update_flow_component_field tool.
Uncontrolled memory consumption in IBM PowerVM NovaLink lets a remote, unauthenticated attacker send a specially-crafted request that drives the server to exhaust memory resources, degrading or halting availability of the virtualization management layer. The CVSS 3.1 base score is 7.5 (High) with an availability-only impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and a vendor patch is available.
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attacker achieve full RCE on default deployments by chaining two endpoints: /api/v1/auto_login, which mints SUPERUSER tokens to any caller, and /api/v1/validate/code, which passes user-supplied code to Python's exec(). CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N) and a vendor patch is available; there is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Missing authentication in IBM Langflow OSS 1.0.0 through 1.10.0 lets unauthenticated remote attackers register unlimited user accounts against any exposed instance. When the documented NEW_USER_IS_ACTIVE=true option is set, those accounts become immediately active and can log in to reach known remote-code-execution endpoints, providing a full authentication foothold without relying on AUTO_LOGIN. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make internet-facing deployments a high priority.
Remote code injection in IBM Langflow OSS 1.0.0 through 1.10.3 allows an authenticated remote attacker to execute arbitrary code on the underlying server by supplying malicious input through user-controlled code fields within the platform. The CVSS vector (AV:N/AC:L/PR:L) confirms the attack is network-reachable at low complexity, requiring only low-privilege credentials, with full confidentiality, integrity, and availability impact on the host. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal in IBM Langflow OSS versions 1.0.0 through 1.10.3 enables authenticated remote attackers to read arbitrary files on the underlying system by submitting URLs containing dot-dot sequences (/../). The CVSS scope change metric (S:C) confirms that exploitation reaches beyond the application's own directory boundary, exposing system-level files such as credentials, configuration, or private keys to any low-privileged account holder. No public exploit code has been identified at time of analysis, though IBM has released a patch via advisory node/7282647.
Cross-user chat history disclosure in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to read other users' conversation history by exploiting session_id collision in the MemoryComponent. The MemoryComponent.retrieve_messages and store_message methods validate only session_id when filtering records, omitting flow_id and user_id ownership checks, which exposes multiple REST API endpoints to unauthorized cross-user data access. No public exploit has been identified at time of analysis, but the straightforward exploitation path and High confidentiality impact make this a genuine remediation priority for any multi-user Langflow deployment.
Broken access control in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to inject arbitrary graph data into the shared execution cache for flows they do not own, via the deprecated POST /api/v1/build/{flow_id}/vertices endpoint. The endpoint performs no ownership validation, enabling cross-user cache pollution that can corrupt other users' workflow state, trigger unauthorized execution of foreign flows, or produce denial of service across a shared platform instance. No public exploit code exists and CISA KEV does not list this vulnerability; EPSS (0.20%, 10th percentile) and SSVC (exploitation: none, automatable: no) collectively indicate low immediate exploitation risk despite the high CVSS score.
Predictable Fernet encryption keys in IBM Langflow OSS 1.0.0 through 1.10.3 allow attackers to decrypt stored API keys and authentication tokens, because when a user secret is shorter than 32 characters the platform derives keys with Python's non-cryptographic `random` (Mersenne Twister) module. Because the Mersenne Twister PRNG is deterministic, identical seeds reproduce identical keys, so an adversary who can reconstruct the seeding conditions can regenerate the key and read every secret Langflow encrypted with it. No public exploit identified at time of analysis; EPSS is low (0.11%) and CISA SSVC records no known exploitation.
Predictable Fernet encryption key generation in IBM Langflow OSS (versions 1.0.0 through 1.10.3) stems from the ensure_fernet_key() function deriving keys from a cryptographically weak source (CWE-338), letting an attacker reconstruct the symmetric key that protects stored secrets such as API keys, credentials, and connection variables. Because the key is guessable rather than random, an actor who can read Langflow's encrypted data store can decrypt it and, depending on how the key is reused, potentially forge or tamper with protected values. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), but IBM rates the flaw CVSS 9.8 and a vendor patch is available.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.10.3 enables authenticated low-privilege users to coerce the application server into issuing arbitrary outbound HTTP requests against internal infrastructure. The root cause is unsanitized pass-through of the OLLAMA_BASE_URL parameter directly into requests.get() inside validate_model_provider_key(), with no scheme enforcement, host allowlisting, or private-range (loopback, RFC1918, link-local) filtering. No active exploitation confirmed (not in CISA KEV), but the network-accessible, low-complexity attack path and high confidentiality impact (C:H) make this a meaningful internal-network pivot risk for organizations running Langflow with AI provider integration enabled.
OS command injection in IBM Langflow OSS 1.0.0 through 1.10.3 enables remote authenticated attackers to execute arbitrary system commands on the underlying server. The flaw stems from insufficient sanitization of user-supplied input passed to OS-level command execution routines (CWE-78), granting full system-level access with a single authenticated request. No public exploit code has been identified at time of analysis, and CISA does not list this in KEV, though CVSS-assessed technical impact is total across confidentiality, integrity, and availability.
Arbitrary OS command execution in IBM Langflow OSS 1.0.0 through 1.10.3 is reachable by any authenticated low-privileged user who can modify MCP server configurations. Improper validation of the command field in those configurations allows injected shell commands to be executed with the application's process privileges, yielding full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible attack path against a growing AI-tooling platform warrants prompt patching.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated remote attackers to run arbitrary commands by supplying crafted configuration parameters that bypass the application's incomplete input denylist (CWE-184). The flaw carries a CVSS 8.8 score with full confidentiality, integrity, and availability impact, and SSVC rates the technical impact as total. No active exploitation is confirmed - EPSS sits at 0.42% (35th percentile) and the vulnerability is absent from CISA KEV - though the low attack complexity makes it a genuine priority for any internet-exposed Langflow deployment with untrusted authenticated users.
Host filesystem read and write access in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by any authenticated low-privilege user via insufficient filtering of Docker volume-mount and device-mapping arguments passed to Docker-based MCP servers. By injecting unsanitized flags such as --volume into MCP server configuration, an attacker can bind-mount arbitrary host directories into a spawned container, exposing or tampering with sensitive files outside the intended Docker isolation boundary. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the network-exploitable, low-complexity attack path and full CIA impact score (CVSS 8.8) make this a high-priority patch target for any organization running Langflow in Docker environments with externally accessible or multi-tenant access.
Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.3 exposes the Model Context Protocol (MCP) composer endpoint to unauthenticated remote access when projects are configured with auth_type=oauth and MCP composer is enabled - which is the default deployment state. An unauthenticated network attacker can reach the MCP composer endpoint and read confidential project data (C:H) without supplying valid credentials, entirely bypassing the OAuth authentication gate. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor (IBM) has confirmed the issue and released a patch.
Remote authenticated attackers can bypass localhost-only access restrictions in IBM Langflow OSS 1.0.0 through 1.10.3 to write arbitrary MCP (Model Context Protocol) server configurations to IDE configuration files on the underlying host system. The CVSS scope change (S:C) confirms this escapes the Langflow application boundary, enabling persistent manipulation of developer IDE environments on the host. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Server-Side Request Forgery in IBM Application Gateway Operator versions 22.2 through 26.06 lets remote unauthenticated attackers coerce the operator into issuing arbitrary HTTP requests by supplying attacker-controlled URLs in custom resources that the operator fails to validate. Because the operator typically runs inside a Kubernetes/OpenShift cluster, this SSRF can reach internal-only services and cloud metadata endpoints. There is no public exploit identified at time of analysis, EPSS risk is low (0.29%, 21st percentile), and CISA SSVC rates exploitation as none.
XML External Entity injection in IBM QRadar SIEM (versions 7.5.0 through 7.5.0 UP 15 IF005 and 7.6.0.0 through 7.6.0.1) lets remote unauthenticated attackers submit crafted XML-formatted syslog events to the parseXmlPayload() function in the event-processing pipeline. When any log source type uses XML-format property autodetection, events arriving on port 514 (UDP/TCP) are parsed without authentication, enabling file disclosure, SSRF, and denial of service. No public exploit identified at time of analysis, but EPSS is a low 0.32% (25th percentile) and IBM has published a fix.
Command injection in IBM QRadar SIEM allows an authenticated privileged user to execute arbitrary OS commands at normal user privilege level due to insufficient input validation (CWE-78). Affected versions span QRadar 7.5.0 through 7.5.0 UP 15 Interim Fix 005 and 7.6.0.0 through 7.6.0.1, placing enterprise security operations centers at risk if SIEM operator accounts are compromised or misused by insiders. No public exploit code exists and no active exploitation is confirmed; EPSS places this at the 13th percentile (0.22%), indicating minimal near-term mass-exploitation probability.
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Liberty Continuous Delivery allows a malicious or attacker-controlled IIOP server to force a WebSphere client/server to load and instantiate arbitrary Java classes over the network. Exploitation requires no authentication or user interaction (CVSS 9.8), and successful abuse can lead to loss of confidentiality, integrity, and availability, potentially culminating in remote code execution via dangerous class instantiation. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.44% probability of exploitation in the next 30 days.
Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 allows an authenticated attacker to run arbitrary code by delivering a malicious serialized Java object through the SOAP/JMX connector, which the server deserializes unsafely (CWE-502). An attacker with low-level credentials who can reach the management connector can achieve full compromise of the application server process. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execute arbitrary code on the underlying host by supplying malicious user-controlled code that is improperly validated (CWE-94). Because Langflow evaluates user-supplied code as part of its low-code AI/agent flow-building functionality, exploitation grants full compromise of the server hosting the application. There is no public exploit identified at time of analysis, but the CVSS 3.1 base score of 9.9 with a scope change reflects that a successful attack can break out of the application context to affect other system components.
Cross-tenant vector document disclosure in IBM Langflow OSS 1.0.0 through 1.10.1 lets an authenticated low-privilege user read another user's private Chroma-backed documents by building a flow that reuses the victim's persist_directory and collection_name, returning exact victim content in the attacker's workflow output. The same shared-namespace flaw also lets the attacker write their own documents into the victim's collection, corrupting its integrity. No public exploit is identified at time of analysis and CISA SSVC rates exploitation as none, but the CVSS 8.1 rating reflects the combined high confidentiality and integrity impact.
Open redirect in IBM Planning Analytics Local versions 2.1.0 through 2.1.21 lets remote attackers craft URLs that bounce authenticated users to attacker-controlled external sites. When the product is deployed with SSO authentication, the redirect can leak session tokens carried in the flow, enabling session hijacking. No public exploit identified at time of analysis; this is not on CISA KEV and no POC is referenced in the provided data.
OS command injection in the IBM Hardware Management Console (HMC) lets a remote, unauthenticated attacker run arbitrary commands with elevated privileges on the management appliance. It affects HMC V10.3.1050.0 through 10.3.1064.0 and V11.1.1110.0 through 11.1.1112.0, the systems used to manage IBM Power servers (including Novalink deployments), stemming from improper validation of user-supplied input (CWE-78). No public exploit has been identified at time of analysis, but the network-reachable, no-authentication vector and 9.8 CVSS make this a top-priority patch.
Denial of service in IBM DataPower Gateway (versions 10.5.0, 10.6.0, 10.6cd, and 11.0.0) allows a remote unauthenticated attacker to exhaust system resources due to improper resource limitations (CWE-770), rendering the gateway unavailable. The CVSS 3.1 base score is 7.5 with an availability-only impact (A:H) and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a vendor patch is available.
Remote code execution in IBM webMethods Integration (on-prem) 10.15 and 10.11 allows an unauthenticated network attacker to run arbitrary code by submitting maliciously crafted serialized data that the platform deserializes without validation (CWE-502). Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with full CIA impact (9.8 Critical), exploitation requires no credentials and no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the vendor (IBM) has released a patch, indicating a confirmed, fixable flaw.
Stack-based buffer overflow in IBM Db2's setgid helper binary db2flacc allows a local user with low privileges to overwrite the stack frame and execute arbitrary code with the elevated group permissions of the binary. Both Db2 11.5.x (through 11.5.9) and 12.1.x (through 12.1.4) are affected. No public exploit has been identified and exploitation status is confirmed as none per SSVC, though IBM has released a patch and the SSVC technical impact is rated total, warranting prompt remediation on shared-access Db2 hosts.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sandbox, allowing a low-privileged authenticated user to escape the sandbox and run arbitrary Python. Because the flaw carries a scope-changing CVSS 3.1 score of 9.9 (S:C, C/I/A all High), a successful exploit can compromise the underlying host beyond the intended sandbox boundary. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file read in IBM Langflow OSS versions 1.0.0 through 1.10.1 allows remote unauthenticated attackers to retrieve files outside the intended web root by submitting URLs containing directory-traversal ("../") sequences. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation needs no authentication or user interaction and can expose sensitive files such as configuration, secrets, or source code. No public exploit identified at time of analysis, and there is no indication of active exploitation.
Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.10.1 lets an authenticated low-privileged user read and tamper with build jobs belonging to other users by abusing improper access control on log-retrieval and unauthenticated build endpoints. Because Langflow orchestrates LLM/agent workflow builds, a cross-tenant attacker can view sensitive build logs (high confidentiality impact) and interfere with others' jobs (limited availability impact). A vendor patch is available; there is no public exploit identified at time of analysis and the flaw is not on CISA KEV.
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary OS commands by injecting shell-control environment variables into the MCP (Model Context Protocol) stdio launcher. The DANGEROUS_ENV_VARS blocklist in src/lfx/src/lfx/base/mcp/util.py omits SHELLOPTS, BASHOPTS, and PS4, letting an attacker abuse Bash's xtrace behavior to execute commands when a stdio-based MCP server subprocess is spawned. Rated CVSS 9.8 with a network, no-privilege, no-interaction vector; a vendor patch is available, but no public exploit code or CISA KEV listing has been identified at the time of analysis.
OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and FW1110 families) allows a low-privileged actor inside a logical partition to issue a carefully crafted hypervisor call that crashes the PowerVM hypervisor or corrupts OS memory. Because the flaw crosses the partition-to-hypervisor trust boundary (CVSS scope change), a single guest partition can impact the integrity and availability of the shared virtualization layer serving other partitions. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; IBM, the reporter, has released a fix.
Denial of service in IBM WebSphere Application Server (9.0, 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote unauthenticated attackers exhaust server resources by sending a single crafted HTTP request, forcing the application server to become unresponsive. The flaw (CWE-400, uncontrolled resource consumption) carries CVSS 7.5 with a full availability impact and requires no privileges or user interaction, making it trivially reachable on any exposed HTTP listener. There is no public exploit identified at time of analysis, but a vendor patch is available from IBM.
Security constraint bypass in IBM WebSphere Application Server 8.5/9.0 (Traditional) and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7 allows a remote, unauthenticated attacker to circumvent access controls and reach protected resources, resulting in disclosure of confidential information (CVSS 3.1 base 7.5, C:H). The flaw stems from an authentication-bypass-by-alternate-name weakness (CWE-289) in how the server evaluates security constraints. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Uncontrolled memory consumption in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.7) lets a remote attacker crash or degrade the server by sending a single specially crafted request that forces excessive memory allocation. The flaw is network-reachable and requires no authentication or user interaction (PR:N/UI:N), and IBM (the reporter) has released a fix. There is no public exploit identified at time of analysis, and no EPSS or CISA KEV data was provided.
Local information disclosure in IBM App Connect Enterprise (versions 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27) occurs because the integration runtime writes potentially sensitive information into log files that any local user can read. An attacker with local access to the host can harvest secrets such as credentials, connection strings, or message payload data from these logs to escalate access or pivot to backend systems. No public exploit identified at time of analysis, and there is no KEV listing; note that the NVD CVSS vector (AV:N) conflicts with the description's explicit 'local user' wording.
Arbitrary code execution in the IBM Aspera Desktop App (versions 1.0.5 through 1.0.19) arises from insecure DLL loading at application start-up, allowing a local low-privileged attacker who can place a malicious DLL in a path the app searches to run code in the context of the launching user. IBM (the reporter and vendor) has published a fix, and there is no public exploit identified at time of analysis. Impact is high to confidentiality, integrity, and availability, but exploitation is gated by local access and the user launching the application.
Reflected cross-site scripting in the administrative console login page of IBM Tivoli System Automation Application Manager 4.1 (a component that also involves IBM WebSphere Application Server) allows a remote attacker to inject and execute arbitrary script in an administrator's browser session. The CVSS 3.1 vector (AV:N/PR:N/UI:R, scope-changed) yields a high 9.3 base score, but exploitation requires tricking an authenticated console user into loading a crafted URL. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Cross-site request forgery in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables server-side request forgery with elevated privileges when the collectiveController-1.0 feature is active. An attacker who lures an authenticated Liberty administrator to a malicious web page can trigger forged requests that the server executes with the victim's elevated privileges, allowing the attacker to reach internal services ordinarily inaccessible from the network perimeter. No public exploit code exists and no confirmed active exploitation is recorded, though the SSVC framework rates the technical impact as total should exploitation occur.
Directory traversal in IBM App Connect Enterprise 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27 lets a remote unauthenticated attacker write arbitrary files by sending a crafted URL containing '../' sequences. Because attacker-controlled file writes on an integration server can overwrite configuration, deployment artifacts, or executable content, this maps to a full-compromise CVSS 9.8. No public exploit identified at time of analysis, but the vendor (IBM) has released a fix.
Command injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2) lets a remote attacker execute arbitrary OS commands by injecting CRLF characters that break the intended neutralization of command input. Rated CVSS 9.8 (network, no authentication, no user interaction) with total confidentiality, integrity, and availability impact; a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS probability is modest at 0.50% (40th percentile).
Arbitrary file read in IBM App Connect Enterprise (versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27) allows a remote, unauthenticated attacker to retrieve files outside the intended directory via a path traversal flaw (CWE-22), scoring CVSS 7.5. The vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no privileges or user interaction, though impact is confined to confidentiality (C:H/I:N/A:N). There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low-complexity, no-auth profile makes it a straightforward disclosure risk once details are known.
Denial of service in IBM Enterprise Build of Quarkus (versions 3.27.1 through 3.27.4.SP2 and 3.33.1 through 3.33.2.SP2) allows a remote, unauthenticated attacker to exhaust memory by sending multipart requests whose MIME part-headers are accumulated without bound in the Quarkus REST layer. Because each part-header buffer grows without a size cap, an attacker can force excessive heap allocation and crash or hang the service, degrading availability for all users. There is no public exploit identified at time of analysis, but the flaw is trivially reachable (AV:N/AC:L/PR:N/UI:N) against any endpoint that accepts multipart input.
Cross-site request forgery in IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.8 enables remote attackers to execute unauthorized actions on behalf of authenticated users without their consent. The vulnerability exploits the server's implicit trust in session cookies, allowing a malicious third-party site to trigger state-changing requests against the Liberty instance. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch.
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.8) lets remote unauthenticated attackers coerce the server into issuing arbitrary requests when the SIP container feature (sipServlet-1.1) is enabled. The flaw carries a CVSS 9.8 rating with total technical impact, and IBM has released a fix (advisory node/7281721); no public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.33%.
Cross-user information disclosure in IBM Langflow OSS 1.0.0-1.10.1 allows authenticated attackers to access private vector content and poison query results by reusing another user's FAISS namespace. This leads to high confidentiality impact and low integrity impact; the vulnerability has a CVSS 3.1 score of 7.1, and a vendor patch is available.
Sensitive information disclosure in IBM Cloud Pak System 2.3.5.0 allows local attackers to obtain credentials from log files. The CVSS score is 7.5 with a network vector, but the description explicitly states local access, creating ambiguity. No public exploit or active exploitation has been identified at the time of analysis.
Unauthenticated administrative access in IBM WebSphere Application Server 9.0 and 8.5 due to broken access control allows remote attackers to gain full control of the server. The vulnerability resides in the administrative console and requires no credentials or user interaction, leading to complete confidentiality, integrity, and availability impact. No public exploit code is known, but a vendor patch is available to remediate this critical risk.
Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unauthenticated attackers to execute arbitrary code or bypass authentication. CVSS 9.8 indicates critical severity with low attack complexity and no user interaction, though no public exploit code or active exploitation has been identified at time of analysis.
Sensitive information disclosure in IBM WebSphere Application Server 8.5 and 9.0 Traditional allows a remote, unauthenticated attacker to obtain confidential data, assessed by IBM as a High-severity issue (CVSS 7.5). The root cause is CWE-532, indicating that sensitive information is inserted into log files or diagnostic output in a manner accessible to remote actors. No public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the CVSS vector attributes high confidentiality impact, and a vendor-released patch is available via IBM support.
Prototype pollution in the @instana/core Node.js tracer, part of IBM Observability with Instana Agent builds 1.0.303 to 1.0.320, allows a local attacker to inject arbitrary properties into JavaScript object prototypes. This can lead to information disclosure and high integrity impact. No public exploit or active exploitation reported; vendor patch is available.
Arbitrary OS command execution is possible in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) through unquoted shell interpolation, allowing a remote attacker who has already obtained high-privilege authentication to run arbitrary commands on the underlying host. The CVSS vector (AV:N/AC:L/PR:H) confirms network reachability with low attack complexity once authenticated, resulting in full confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via the advisory at https://www.ibm.com/support/pages/node/7280530.
Shell command injection in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) permits a remote attacker holding high-privilege credentials to execute arbitrary operating system commands on the underlying server. The CVSS 7.2 High score reflects full confidentiality, integrity, and availability impact, substantially gated by the PR:H authentication requirement. No public exploit has been identified at time of analysis, and both EPSS (1.04%, 60th percentile) and CISA SSVC (Exploitation: none) align on low current exploitation activity; a vendor patch is confirmed available.
Path traversal vulnerability in IBM Aspera Desktop App 1.0.5–1.0.19 allows remote attackers to write files outside the user’s intended download directory by enticing a user to interact with a malicious download request or file. No active exploitation or public exploit code has been identified at the time of analysis, and a vendor patch is available.
Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network attacker to run arbitrary code by sending crafted serialized data that the server deserializes without validation (CWE-502). The flaw carries a CVSS 9.8 rating with a network attack vector and no authentication or user interaction required, though SSVC records exploitation as none observed and no public exploit was identified at time of analysis. EPSS is low at 0.37% (29th percentile), indicating that active, widespread exploitation has not yet materialized despite the maximal technical impact.
Remote code execution in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows unauthenticated network attackers to execute arbitrary code when the collectiveController-1.0 feature is enabled. Rooted in a missing-authentication weakness (CWE-306) on collective controller management functions, the flaw carries a 9.8 CVSS score and total technical impact per CISA's SSVC framework. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), but the network-reachable, unauthenticated nature makes it a high-priority patch where the collective feature is in use.
Denial of service in IBM WebSphere Application Server 9.0, 8.5 and Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to consume server resources via malicious HTTP requests exploiting unbounded resource allocation. This can render the service unavailable. No active exploitation or public exploit has been identified.
Improper session expiration in IBM Aspera Faspex 5 allows remote unauthenticated attackers to access sensitive data. The vulnerability, tracked as CVE-2026-14996, affects versions 5.0.0 through 5.0.15.4 and stems from insufficient session invalidation (CWE-613). Attackers who obtain a valid session token can reuse it after the intended lifetime, compromising confidentiality of file transfer data with limited integrity impact.
Authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows a remote unauthenticated attacker to send a specially crafted request and reach protected resources without valid credentials, with CVSS rating full compromise of confidentiality, integrity, and availability. The flaw stems from missing authorization enforcement (CWE-862) and carries a CVSS 9.8 requiring no user interaction or privileges. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.31% (24th percentile) and CISA SSVC currently rates exploitation as 'none' with only partial technical impact.
Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to cause service disruption via uncontrolled heap allocation, resulting in high availability impact. No public exploit or active exploitation reported; vendor patch is available.
HTTP response smuggling in IBM WebSphere Application Server 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to poison intermediate caching proxies by exploiting improper handling of non-standard HTTP version tokens. Successful exploitation leads to high confidentiality and integrity impact through cache poisoning, potentially enabling information disclosure and malicious content injection into proxied responses. A vendor patch is available, though no public exploit code or active exploitation has been reported at this time.
Information disclosure in IBM WebSphere Liberty ND Collective Controller, versions 17.0.0.3 through 26.0.0.8, allows remote unauthenticated attackers to read arbitrary files via path-segment injection in the collective routing mechanism. Successful exploitation exposes sensitive configuration data without user interaction or authentication. No public exploit or active exploitation (CISA KEV) has been reported at this time.
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7 allows remote attackers to poison request queues, potentially leading to unauthorized information disclosure and cache poisoning. The flaw stems from improper handling of TRACE requests, with a CVSS base score of 8.7 but no evidence of active exploitation or public exploit code at the time of analysis.
HTTP request smuggling in IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) enables remote unauthenticated attackers to poison shared HTTP connections between a front-end proxy and the application server backend. The CVSS 8.1 score reflects full confidentiality, integrity, and availability impact (C:H/I:H/A:H) but is constrained by high attack complexity (AC:H), requiring a specific proxy-to-WAS pipeline configuration to exploit. No public exploit is identified at time of analysis; EPSS is very low at 0.21% (11th percentile) and SSVC confirms no known exploitation, though technical impact is rated total.
SQL injection in IBM Sterling B2B Integrator and File Gateway allows authenticated remote attackers to view, add, modify, or delete database contents. Affects versions 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. No public exploit or active exploitation (KEV) known at time of analysis.
Privilege escalation in IBM OpenBMC firmware allows any authenticated ReadOnly user to grant themselves full administrator access over the BMC interface on affected IBM Power Systems servers. The flaw spans two firmware release trains - FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 - across more than a dozen IBM Power9 and Power10 server models. No public exploit code or active exploitation has been identified; EPSS is 0.17% (7th percentile) and SSVC classifies exploitation as none, but the consequence of BMC administrator access is severe given the out-of-band control it provides over physical infrastructure.
We are tasked with synthesizing data from multiple sources about CVE-2026-64318 into a comprehensive analysis, returning a JSON object with specified fields. Let's carefully parse the provided information. CVE-2026-64318: In the Linux kernel, a vulnerability in the AIX partition handling. The description: "aix_partition() reads the physical volume descriptor... pp_count is unvalidated, so a crafted AIX image with pp_count > 1016 drives an out-of-bounds read... bound the scan to array size." From description: - Product: Linux kernel, specifically the partition handling for AIX disks (block/partitions/aix.c). So product_name: "Linux Kernel". - CVSS Score: 7.1, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - CWE: N/A - EPSS: 0.22% (percentile 13%) - Patch: Available from vendor - Tags: Linux, IBM, Information Disclosure - KEV status: not mentioned (likely not KEV). POC? Not mentioned. So no active exploitation or public exploit identified from data. - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (but note: Linux kernel is typically "o:linux:linux_kernel", but given as "a" application? The data says "cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*". We'll use it as is, but product_name Linux kernel is correct.) - Affected versions: We have a list of git commit ranges and patches. We can extract the fix versions: mention specific stable versions patched: 7.1.4, 6.18.39, 5.15.212, 5.10.261, 7.2-rc1, 6.6.145, 6.12.96, 6.1.178, and the initial commit from 3.11. So the vulnerability was introduced long ago (Linux 3.11) and fixed in multiple stable branches. The description mentions "Linux 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 < ..." which is the commit that fixed it? Possibly the fix commit. The EUVD entries give commit ranges where the vulnerability exists. We'll synthesize: Affected: Linux kernel versions from 3.11 up to before the fix in the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1, 7.2 series. So we can say "Linux kernel versions prior to the patched releases: 5.10.261, 5.1
Cross-user file access in IBM Langflow OSS (1.0.0 through 1.10.1) lets an authenticated user abuse the SaveToFile component to read and modify files uploaded by other users by supplying absolute paths that point into victim storage locations. Append mode enables exfiltration of victim data into the attacker's namespace (confidentiality), while overwrite mode allows replacing victim content with arbitrary data (integrity), collapsing the per-user storage ownership boundary. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.
Authentication bypass and full data compromise affects IBM Langflow OSS 1.0.0 through 1.10.1, which ships hard-coded credentials (a static password or cryptographic key) embedded in the application. Because the same secret is present in every deployment, remote attackers who read it from the public source or a binary can authenticate to inbound interfaces, impersonate the app to external components, or decrypt internal data on any affected instance. No public exploit identified at time of analysis, but the shared-secret nature makes exploitation trivial once the value is known.
Denial of service in IBM Engineering Lifecycle Management's DOORS component exposes unauthenticated remote attackers to crash or degrade the service by submitting XML payloads exploiting recursive entity expansion. Affected deployments span three active release branches - 7.0.3 through Interim Fix 021, 7.1.0 through Interim Fix 009, and 7.2.0 including Interim Fix 001. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.36% (28th percentile) confirms low current exploitation activity, but the unauthenticated network vector makes remediation advisable for internet-facing or low-trust-network deployments.
IBM PowerVM Novalink API misconfiguration (CWE-16) expands the attack surface and enables unauthorized virtualization management operations under non-default configurations. Versions 2.2.0 through 2.2.1.1 and 2.3.0 through 2.3.2 are confirmed affected via NVD CPE data, with a low-privileged local attacker potentially achieving full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and an EPSS score of 0.10% at the 1st percentile signals negligible exploitation activity - real-world risk is constrained by the non-default configuration prerequisite and local-only attack vector.
Remote code execution and information disclosure in IBM Db2 Genius Hub (1.1, 1.1.1, 1.1.2) and IBM Agentics 1.0 stem from the use of inherently dangerous functions invoked without sufficient input restrictions, allowing remote attackers to run arbitrary code or read sensitive data. IBM's PSIRT reported the flaw with a 9.8 critical CVSS reflecting network-reachable, unauthenticated exploitation with full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, and the low EPSS score (0.33%, 25th percentile) suggests exploitation is not yet widespread.
OS command injection in IBM Langflow OSS versions 1.0.0 through 1.10.1 lets an authenticated user run arbitrary system commands with elevated privileges by abusing improper input validation in the Python Interpreter component. Because the flaw sits in a feature that already executes user-supplied Python, any logged-in user can escalate to full host command execution (CVSS 8.8, CWE-78). No public exploit identified at time of analysis, though the low attack complexity and network vector make it high-priority for any exposed Langflow deployment.
Heap-based buffer overflow in IBM Storage Protect Client (versions 8.1.0.0-8.1.27.1 and 8.2.0.0-8.2.1.0) lets a remote attacker corrupt heap memory through improper bounds checking, potentially achieving arbitrary code execution or crashing the affected process. The flaw carries a CVSS 3.1 base score of 9.8, but no public exploit identified at time of analysis and the EPSS probability is low (0.46%, 37th percentile). Note that the affected component is the backup Client, while the description references crashing 'the server,' introducing ambiguity about the true exploitation path.
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.1 lets anonymous attackers run arbitrary code by abusing the public flow build endpoint (/api/v1/build_public_tmp/{flow_id}/flow). The CVSS 3.1 base score is 9.8 (network, low complexity, no privileges or user interaction). No public exploit is identified at time of analysis, and the EPSS probability is modest at 0.44% (36th percentile), indicating exploitation is technically trivial but not yet observed at scale.
Stored/reflected cross-site scripting in IBM Engineering AI Hub 1.0.0 through 1.2.0 lets a remote unauthenticated attacker inject arbitrary scripts into generated web pages that execute in a victim's authenticated browser session. Because the CVSS scope is marked changed (S:C), successful exploitation can impact resources beyond the vulnerable component - such as the user's session with adjacent applications. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Sensitive information disclosure in IBM Engineering AI Hub 1.0.0 through 1.2.0 allows remote attackers to harvest session tokens that the application places directly in URLs, enabling session hijacking and account takeover. IBM (the reporting vendor) has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. The CWE-598 root cause means tokens leak passively into browser history, referer headers, proxy and server access logs rather than requiring an active attack against the server.
TLS protocol downgrade in IBM i 7.3 through 7.6 enables remote attackers to force negotiation of TLS versions explicitly disabled in the server configuration, undermining the operator's security posture by exposing session traffic to potential decryption. The CVSS vector (AV:N/AC:H/PR:N) confirms this is network-exploitable without authentication but requires high attack complexity, consistent with a man-in-the-middle positioning requirement during the TLS handshake. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; a vendor patch is available per IBM advisory 7278992.
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user create a malicious flow that points to an attacker-controlled URL returning a crafted Content-Disposition header, causing the Langflow process to write attacker-supplied content to any filesystem path it can access. Because writes can land on startup scripts, keys, or configuration files, this path-traversal (CWE-22) flaw is a realistic route to full server compromise. IBM has released a fix; no public exploit identified at time of analysis and the CVE is not in CISA KEV.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated remote attacker to run arbitrary code because validation is not fully enforced on Model Context Protocol (MCP) server configuration files, permitting injection of attacker-controlled commands or server definitions. IBM has published a fix advisory (node/7278932). With CVSS 8.8 (PR:L), a low-privileged user of the Langflow instance can escalate to full code execution on the host; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file read in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated attacker traverse the filesystem to exfiltrate sensitive files - most critically the JWT signing key - and then forge valid authentication tokens to impersonate any user, including administrators. The path-traversal-to-account-takeover chain turns a low-privilege foothold into full application compromise. No public exploit identified at time of analysis, and the EPSS score is low (0.38%, 31st percentile), but a vendor patch is available and the impact is severe.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override arbitrary component parameters at runtime through the API, bypassing the parameter filtering logic in the apply_tweaks() function (CWE-94 code injection). Because a low-privileged authenticated account is sufficient and the impact is full compromise of confidentiality, integrity, and availability (CVSS 8.8), this maps to server-side code execution on the Langflow host. There is no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a malicious pickle payload that the AsyncDiskCache deserializes with unauthenticated pickle.loads(). Any actor able to influence cached data - via file system access, crafted workflow inputs, custom components, or API manipulation - gains full compromise at the privilege of the Langflow server process. Rated CVSS 9.9 and reported by IBM with a vendor patch available; no public exploit identified at time of analysis.
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Python — and therefore arbitrary OS commands — with the privileges of the Langflow server process. The flaw is a design failure in the POST /api/v1/validate/code endpoint, which passes user-supplied code straight into Python's exec() with no sandbox, validation, or privilege drop. Rated CVSS 9.9 by IBM; no public exploit identified at time of analysis, though the trivial exec()-based trigger makes exploitation straightforward once authenticated.
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 stems from broken webhook authentication that skips API key validation whenever WEBHOOK_AUTH_ENABLE is False - which is the shipped default. Any remote attacker who learns a flow's UUID can invoke that flow's webhook endpoint as though they were its owner, running arbitrary flow logic and reaching RCE. No public exploit identified at time of analysis, but the CVSS 9.8 rating and default-vulnerable configuration make this a high-priority patch.
Privilege escalation to remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated user to elevate their account to superuser by directly manipulating the underlying database, then execute arbitrary system commands and achieve full compromise of the host running the Langflow service. The flaw (CWE-94, code injection) carries a critical CVSS 9.9 with a scope change, meaning code runs with the Langflow service account's permissions beyond the vulnerable component. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a vendor patch is available.
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plant files at attacker-chosen paths on the Langflow host. The flaw lives in the APIRequest component's 'Save to File' feature, which trusts filenames from a response Content-Disposition header without sanitizing path traversal sequences, so a malicious server response can escape the temporary directory and write to any location the Langflow process can reach. No public exploit identified at time of analysis, and it is not in CISA KEV; a patch is available per IBM's advisory.
Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.0 lets an unauthenticated remote attacker retrieve a long-lived superuser bearer token from the /api/v1/login/auto_login endpoint whenever the AUTO_LOGIN setting is on - which is the default. Because the endpoint mints full-admin tokens with no credentials, any network-reachable attacker gains complete administrative control, and overly permissive CORS can leak those tokens to unintended origins. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenticated users with flow-creation privileges to bypass the allow_custom_components=false control via the Policies component's ToolGuard integration. Because validation only inspects the main component code and ignores dynamic CodeInput fields, attackers persist malicious Python in a flow that runs server-side when a guarded tool executes. No public exploit has been identified at time of analysis, but the flaw is IBM-confirmed with a vendor patch and carries a critical 9.9 CVSS due to cross-tenant escalation through the agentic MCP update_flow_component_field tool.
Uncontrolled memory consumption in IBM PowerVM NovaLink lets a remote, unauthenticated attacker send a specially-crafted request that drives the server to exhaust memory resources, degrading or halting availability of the virtualization management layer. The CVSS 3.1 base score is 7.5 (High) with an availability-only impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and a vendor patch is available.
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attacker achieve full RCE on default deployments by chaining two endpoints: /api/v1/auto_login, which mints SUPERUSER tokens to any caller, and /api/v1/validate/code, which passes user-supplied code to Python's exec(). CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N) and a vendor patch is available; there is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Missing authentication in IBM Langflow OSS 1.0.0 through 1.10.0 lets unauthenticated remote attackers register unlimited user accounts against any exposed instance. When the documented NEW_USER_IS_ACTIVE=true option is set, those accounts become immediately active and can log in to reach known remote-code-execution endpoints, providing a full authentication foothold without relying on AUTO_LOGIN. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make internet-facing deployments a high priority.