Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-08-29 | 1 | Disclosure1 |
| 2026-08-31 | 2 | Disclosure2 |
Warning: Critical Remote Code Execution flaws in IBM #Langflow OSS. CVE-2026-19295, CVE-2026-19286 CVSS: 9.9, 9.8. These vulnerabilities can lead to remote code execution. #Patch #Patch #Patch
Post summary
Advisory warns of two high‑severity CVEs that enable remote code execution in IBM Langflow OSS.
#schwachstellen CVE-2026-19286: IBM Langflow OSS erlaubt unter Umständen Remote Code Execution #cve202619286 #ibm #langflowoss https://cybersecurity-news.de/cve-2026-19286-ibm-langflow-oss-remote-code-execution
Post summary
IBM Langflow OSS is found vulnerable to remote code execution under certain circumstances, as disclosed for CVE-2026-19286.
NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 29 Aug 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Outdated AI workflow builder — code execution on the server, some of it with no login at all (IBM Langflow OSS CVE-2026-19286, CVE-2026-19295, CVE-2026-18729, CVE-2026-18891, CVE-2026-18904, CVE-2026-18899, CVE-2026-19294, CVE-2026-18545) 🖥️ Admin API shipped with authentication off — anonymous superuser on the cluster: add users, rewrite ACLs, drop brokers (Redpanda CVE-2026-82266) 🔑 API hands out the app's own web UI password — along with the host's model and data paths (Stable Diffusion WebUI CVE-2026-82288) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #RCE #CSO #REDTEAM
Post summary
The post lists several new CVEs with functional details but offers no evidence of active exploitation, PoC, or patch availability.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | langflow | langflow | - | - | - |