Security Vulnerabilities
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.
CVSS Score
7.1
EPSS Score
0.001
Published
2026-10-07
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
CVSS Score
8.8
EPSS Score
0.004
Published
2026-10-07
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command ('Code Injection'), aka improper control of code generation.
CVSS Score
8.1
EPSS Score
0.003
Published
2026-10-07
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code, resulting in a sandbox escape.
CVSS Score
8.8
EPSS Score
0.005
Published
2026-10-07
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
CVSS Score
8.8
EPSS Score
0.004
Published
2026-10-07
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation.
CVSS Score
8.8
EPSS Score
0.004
Published
2026-10-07
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem.
CVSS Score
8.3
EPSS Score
0.003
Published
2026-10-07
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
CVSS Score
8.5
EPSS Score
0.007
Published
2026-10-07
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
CVSS Score
9.8
EPSS Score
0.008
Published
2026-10-07
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.
CVSS Score
8.8
EPSS Score
0.007
Published
2026-10-07