{"data":{"id":"674d5bd9-3fe6-4f48-95c1-5eb76db8600a","title":"CVE-2026-3346: IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting. This vulnerability…","summary":"CVE-2026-3346 affects IBM Langflow Desktop versions 1.6.0 through 1.8.4. An authenticated user can embed arbitrary JavaScript in the Web UI, altering its intended functionality and potentially leading to credentials disclosure within a trusted session. The source lists CWE-89 (SQL Injection) as the weakness, and NVD had not yet provided an assessment at the time of publication on 04/30/2026.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-3346","publishedAt":"2026-04-30T21:16:32.610Z","cveId":"CVE-2026-3346","cweIds":["CWE-89"],"cvssScore":"6.4","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["IBM Langflow Desktop"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"IBM Langflow Desktop stored cross-site scripting in the Web UI","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00157,"epssCheckedAt":"2026-11-09T18:09:51.567Z","kevDateAdded":null,"advisoryAliases":["GHSA-m357-46wc-mgw8"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T12:11:02.136Z","patchAvailable":null,"disclosureDate":"2026-04-30T21:16:32.610Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-66"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}