CVE-2026-90991

MediumCVSS 6.5/10Last modified Oct 30, 2026

Description

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

VendorProductVersions
IBMLangflow OSS>= 1.0.0, <= 1.12.4

References

Timeline

Published
Oct 29, 2026
Last modified
Oct 30, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-909926.4The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field inCVE-2026-90993XXE vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to uCVE-2026-909944.0A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data()CVE-2026-909955.5A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable AuthenticationCVE-2026-909965.5A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security SCVE-2026-909977.4A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database CVE-2026-909999.8Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become codeCVE-2026-91007.1The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents inCVE-2026-910008.4Missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: bCVE-2026-910019.9A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS CVE-2026-910025.3A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function _blacklist of the file core/httpd.pCVE-2026-910039.1A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI Serv
CVE-2026-90991: Medium severity, CVSS 6.5 | Vulnix