IBM DataPower Gateway contains an out-of-bounds write caused by improper bounds checking, which can lead to a buffer overflow. According to the IBM CVE description, a local user could exploit it to execute arbitrary code on the appliance. The CVSS vector (AV:N, PR:N) instead describes a network attack without authentication, so the exposure must be treated as possibly remote until IBM clarifies this conflict.
IBM · DataPower Gateway
IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 contain a cross-site scripting flaw in the Web UI. An unauthenticated attacker can embed arbitrary JavaScript, which may alter the intended functionality of the interface and potentially lead to credentials disclosure within a trusted administrative session. IBM rates the issue CVSS 9.3 (Critical); the user interaction component (UI:R) means a victim must act, for example by opening a crafted link.
IBM · DataPower Gateway
IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.1 to 10.6.6, 10.6.0.0 to 10.6.0.10 and 11.0.0.0 to 11.0.0.2 contain an out-of-bounds write in the RFC2047 encoded-word parser. A remote attacker can exploit this without authentication or user interaction to execute arbitrary code on the gateway. The CVSS score is 9.8 (critical); the exact feature and input are not described by the vendor.
IBM · DataPower Gateway
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
IBM Langflow OSS versions 1.0.0 through 1.12.2 contain an improper access control flaw in the vertex result caching subsystem. A remote attacker with a low-privilege authenticated account can obtain sensitive information or inject malicious data into cached results. No user interaction is required, so the risk is mainly relevant for multi-user Langflow deployments.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a code injection flaw (CWE-94) related to improper input validation in OS command handling. A remote attacker with valid credentials can execute arbitrary code with the privileges of the Langflow service. Authentication is required, and the CVSS base score is 8.8 (High). Langflow hosts often store API keys and connect to other systems, so the impact can extend beyond the instance itself.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a flaw caused by improper input validation (CWE-693). A remote attacker with a valid, low-privilege account can execute arbitrary code. Anonymous access is not sufficient, but code runs with the privileges of the Langflow process, so stored credentials, API keys and connected services are at risk. Technical details of the affected code path are not disclosed.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a flaw that allows a remote attacker with a valid user account to execute arbitrary code. The flaw is a sandbox escape caused by improper neutralization of special elements used in code. The attack requires authentication, but any account that can create or run flows could reach code execution on the server.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a code injection flaw (CWE-94) in how special elements are handled before OS commands run. A remote attacker with a valid, low-privilege account can execute arbitrary operating system commands on the host. Exploitation requires authentication but no user interaction, and the CVSS 3.1 base score is 8.1 (High). The vector reports high confidentiality and integrity impact and no availability impact.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a flaw caused by improper input validation (CWE-693). A remote attacker with a valid low-privilege account can execute arbitrary code without user interaction. Code runs with the privileges of the Langflow service, which often holds API keys and access to other internal systems. The flaw is one of about 25 Langflow issues IBM disclosed together; several of those are unauthenticated and more severe.
IBM · Langflow OSS
Langflow OSS versions 1.0.0 through 1.12.2 contain an incomplete blocklist in the code security scanner. An attacker who can reach the service may be able to execute arbitrary code on the server. According to the vendor's CVSS vector, the attacker needs low privileges, such as a user account, and no user interaction is required.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by a dependency confusion flaw, classified as an expected behavior violation (CWE-440). According to the CVE record, a remote attacker can execute arbitrary code, with high impact on confidentiality, integrity and availability. Sources disagree on the CVSS score (9.8 vs. 8.8) and on whether user interaction is required, so the exact attack conditions are not confirmed.
IBM · Langflow OSS
IBM Langflow OSS, the open-source edition of the Langflow platform for orchestrating language models, contains a code injection flaw (CWE-94) in its handling of OS commands. According to the CVE record, a remote attacker can execute arbitrary code on the server, which can fully compromise its confidentiality, integrity and availability. The NVD record lists no privileges required, but the sources conflict on whether authentication is needed, so treat the flaw as potentially unauthenticated until IBM clarifies. The same IBM bulletin lists several other Langflow OSS vulnerabilities in the same version range.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a code injection flaw (CWE-94) that allows a remote attacker with a valid user account to execute arbitrary code. Successful exploitation runs code with the privileges of the Langflow service, which can expose secrets, API keys and data the service can access. The CVSS base score is 8.8 (high), and the attack requires only low-privilege authentication.
IBM · Langflow OSS
IBM Langflow OSS, an open-source low-code tool for building AI agents and applications, contains a code injection flaw (CWE-94) in its code generation handling. A remote attacker with a valid user account can execute arbitrary code with the privileges of the Langflow process. An attacker with code execution can reach stored credentials and connected data. The flaw is rated CVSS 8.8 (high).
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a code injection flaw (CWE-94) that allows a remote attacker with a valid account to execute arbitrary code. Successful exploitation runs code with the privileges of the Langflow service, which can expose stored API keys, model credentials and data. IBM rates the issue at CVSS 8.8 and recommends upgrading to version 1.12.3.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a code injection flaw (CWE-94) in code generation. A remote attacker with a valid user account can execute arbitrary code on the host running Langflow, with high impact on confidentiality, integrity and availability (CVSS 8.8). Details of the flaw are not public, and the IBM bulletin does not clearly separate this CVE from the other Langflow CVEs it lists.
IBM · Langflow OSS
