Version 11.0 (versionCode 11) of the ShoppingList Android app exports an import activity without permission protection. Any app installed on the same device can send a crafted shopping list to it, which is then written to the local database and shown to the user without confirmation. The attacker cannot read existing lists or run code, and the attack requires a locally installed app.
wbpxre150 · ShoppingList
Tarnhelm 1.8.2 (versionCode 20250630) for Android exports a headless activity without a permission check. Any app installed on the same device, even one holding no runtime permissions, can start it and silently replace the clipboard content with its own text. The user's next paste may then insert attacker-controlled data. The NVD record describes the attack vector as network, but the third-party advisory describes a local attack that requires a malicious app on the device, so the actual exposure needs verification.
lz233 · Tarnhelm
Share to Clipboard for Android, version 1.14.1 (versionCode 32), exports an activity that is not protected by a permission. Any app installed on the same device can start it and silently replace the content of the system clipboard with its own text, without confirmation. The attacker cannot read the clipboard, and no code execution or privilege escalation is claimed. The risk is that a value a user pastes later, such as a password or customer data, has been replaced.
Tengu · Share to Clipboard
WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) for Android exports a headless activity without a permission or caller check. Any app installed on the same device can append text to the app's snippet store and, according to the advisory, read the stored snippets back through the app's own list screen. The CVE record describes data export by an unauthorized attacker, with no user interaction needed. The NVD score of 7.5 conflicts with the VulDB rating, and the advisory's mechanism has not been independently confirmed.
Michael Butscher · WikiAndPad alpha/beta
Research and translation in progress – available shortly.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain an OS command injection flaw (CWE-94 per NVD, description matches CWE-78) that allows remote code execution on the server. According to the CVE record, an attacker needs no privileges and no user interaction, so the flaw is reachable over the network. The CVSS base score is 9.8 (critical), and the CVE was published on 29 October 2026.
IBM · Langflow OSS
Research and translation in progress – available shortly.
IBM Langflow OSS versions 1.0.0 through 1.12.3 do not properly neutralize special elements used in an OS command. A remote attacker with a valid, low-privileged account can execute arbitrary code on the server without user interaction, which may expose stored credentials such as API keys. Langflow listens on localhost by default, so the risk depends on how it is deployed and who can reach it.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.3 deserialize untrusted data unsafely. A remote attacker with any valid Langflow account can execute arbitrary code on the server, with the privileges of the Langflow service. The vendor rates the issue CVSS 8.8 and no user interaction is required.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.3 deserialize untrusted data from the message broker. A remote attacker who can reach the message broker can execute arbitrary code on the system. The NVD record rates the issue CVSS 9.8 (critical), but other sources rate it lower, so the score should be verified. No exploitation is known.
IBM · Langflow OSS
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain an improper access control flaw that allows a remote attacker with a valid user account to execute arbitrary SQL commands. Successful exploitation could allow an attacker to read, modify or delete data in the underlying database. NVD lists a CVSS score of 8.8, while IBM lists 8.5 with a scope change for this CVE.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) flaw. A remote attacker with a low-privilege authenticated account can make the server send requests to other systems, which may expose sensitive information. The NVD and IBM CVSS scores differ, so check the current NVD record before relying on either score.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a code injection flaw (CWE-94) caused by improper neutralization of special elements. A remote attacker with a valid low-privilege account can execute arbitrary code on the server, with high impact to confidentiality, integrity and availability (CVSS 8.8). The exact vulnerable component and trigger are not publicly described.
IBM · Langflow OSS
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
