CVE-2026-77817

MediumCVSS 6.5/10Last modified Nov 2, 2026

Description

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Oct 29, 2026
Last modified: Nov 2, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-778186.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulti CVE-2026-778196.5IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of CVE-2026-77826.3A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1. This affects the function Clients::project of the file application/contro CVE-2026-778206.4The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and CVE-2026-778229.6IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery CVE-2026-778234.9The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv AJAX action in versio CVE-2026-778244.9The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all vers CVE-2026-778254.9IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint (`GET /v1/admin/log CVE-2026-778268.8The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accept CVE-2026-778277.1Maono Link 3.8.13 MaonoAiServices Windows service allows local privilege escalation for a standard user account via improper write privilege CVE-2026-778296.4The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all CVE-2026-77836.3A flaw has been found in CodeCanyon Perfex CRM up to 3.4.1. This vulnerability affects the function AbstractKanban::applySortQuery of the fi