Version 11.0 (versionCode 11) of the ShoppingList Android app exports an import activity without permission protection. Any app installed on the same device can send a crafted shopping list to it, which is then written to the local database and shown to the user without confirmation. The attacker cannot read existing lists or run code, and the attack requires a locally installed app.
wbpxre150 · ShoppingList
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain an OS command injection flaw (CWE-94 per NVD, description matches CWE-78) that allows remote code execution on the server. According to the CVE record, an attacker needs no privileges and no user interaction, so the flaw is reachable over the network. The CVSS base score is 9.8 (critical), and the CVE was published on 29 October 2026.
IBM · Langflow OSS
Research and translation in progress – available shortly.
IBM Langflow OSS versions 1.0.0 through 1.12.3 do not properly neutralize special elements used in an OS command. A remote attacker with a valid, low-privileged account can execute arbitrary code on the server without user interaction, which may expose stored credentials such as API keys. Langflow listens on localhost by default, so the risk depends on how it is deployed and who can reach it.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.3 deserialize untrusted data unsafely. A remote attacker with any valid Langflow account can execute arbitrary code on the server, with the privileges of the Langflow service. The vendor rates the issue CVSS 8.8 and no user interaction is required.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.3 deserialize untrusted data from the message broker. A remote attacker who can reach the message broker can execute arbitrary code on the system. The NVD record rates the issue CVSS 9.8 (critical), but other sources rate it lower, so the score should be verified. No exploitation is known.
IBM · Langflow OSS
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain an improper access control flaw that allows a remote attacker with a valid user account to execute arbitrary SQL commands. Successful exploitation could allow an attacker to read, modify or delete data in the underlying database. NVD lists a CVSS score of 8.8, while IBM lists 8.5 with a scope change for this CVE.
IBM · Langflow OSS
Research and translation in progress – available shortly.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a code injection flaw (CWE-94) caused by improper neutralization of special elements. A remote attacker with a valid low-privilege account can execute arbitrary code on the server, with high impact to confidentiality, integrity and availability (CVSS 8.8). The exact vulnerable component and trigger are not publicly described.
IBM · Langflow OSS
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
