{"data":{"id":"1169f174-f83a-4086-9d63-eeb98851508d","title":"CVE-2026-10700: IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API th","summary":"IBM Langflow OSS versions 1.0.0 through 1.8.4 have broken access control vulnerabilities in its file handling API (a set of tools that lets software request files). One endpoint allows anyone to download image files without logging in, while another endpoint lets logged-in users access files belonging to other users by guessing file identifiers, potentially exposing sensitive data across multiple users.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10700","publishedAt":"2026-07-30T19:17:02.100Z","cveId":"CVE-2026-10700","cweIds":["CWE-639"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["LangChain"],"affectedVendorsRaw":["IBM Langflow"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-07-30T19:17:02.100Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}