CVE-2026-7700

MediumCVSS 6.3/10Last modified Oct 6, 2026

Description

A weakness has been identified in langflow-ai langflow up to 1.10.2. This affects the function eval of the file src/lfx/src/lfx/components/llm_operations/lambda_filter.py of the component LambdaFilterComponent. Executing a manipulation can lead to code injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-94

Affected software

No affected versions have been published.

Timeline

Published
May 3, 2026
Last modified
Oct 6, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-770009.8The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity providCVE-2026-770019.8The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisatCVE-2026-770029.8The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to autheCVE-2026-770032.7The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing useCVE-2026-770047.4A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptesCVE-2026-770059.6The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not CVE-2026-770069.6The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user maCVE-2026-770077.5The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of itsCVE-2026-770086.5The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication checCVE-2026-770099.9The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, CVE-2026-77014.3A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestButton of the filCVE-2026-770106.5The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API
CVE-2026-7700: Medium severity, CVSS 6.3 | Vulnix