CVE-2026-7803

CriticalCVSS 9.8/10Last modified Jul 2, 2026

Description

IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jun 30, 2026
Last modified: Jul 2, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-780309.8DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes th CVE-2026-780329.3SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server priv CVE-2026-780378.8Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to CVE-2026-780385.9Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose inp CVE-2026-78046.1The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter i CVE-2026-780435.6The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration dir CVE-2026-780475.1A stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated ad CVE-2026-78048A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all pl CVE-2026-780493.7A vulnerability has been found in Systerel S2OPC up to 1.7.3. Impacted is the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes CVE-2026-780509.9A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?metho CVE-2026-780515.3A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metub CVE-2026-780544.3A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /BSIS1.p