Security Vulnerabilities
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments.
CVSS Score
8.8
EPSS Score
0.003
Published
2026-08-05
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to improper validation of configuration parameters.
CVSS Score
7.2
EPSS Score
0.004
Published
2026-08-05
IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of URLs specified in custom resources.
CVSS Score
8.5
EPSS Score
0.003
Published
2026-08-05
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.
CVSS Score
8.1
EPSS Score
0.004
Published
2026-08-05
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing answer content that should not have been accessible.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.
CVSS Score
7.5
EPSS Score
0.004
Published
2026-08-05
Insufficient Session Expiration vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.
CVSS Score
9.1
EPSS Score
0.003
Published
2026-08-05
Insufficient Verification of Data Authenticity vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.
CVSS Score
7.5
EPSS Score
0.004
Published
2026-08-05
Improper Input Validation vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.
CVSS Score
6.5
EPSS Score
0.003
Published
2026-08-05
Improper Authorization vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.
CVSS Score
6.5
EPSS Score
0.003
Published
2026-08-05
Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.
CVSS Score
7.5
EPSS Score
0.005
Published
2026-08-05