Skip to contentLangflow vulnerabilities
Newest
- langflowLangflow has Authenticated Code Execution in Agentic Assistant ValidationCVE-2026-33873Fix available9.3 Critical
- langflowLangflow GitHub Actions Shell InjectionCVE-2026-33475Public exploit9.1 Critical
- langflowLangflow: /profile_pictures/{folder_name}/{file_name} endpoint file readingCVE-2026-33497Fix availableEPSS 20.0%8.7 High
- langflowLangflow has Unauthenticated IDOR on Image DownloadsCVE-2026-33484Fix available7.5 High
- langflowLangflow has an Arbitrary File Write (RCE) via v2 APICVE-2026-33309Fix availableEPSS 13.8%10.0 Critical
- langflowLangflow has Missing Ownership Verification in API Key Deletion (IDOR)CVE-2026-33053Fix available6.1 Medium
- langflowLangflow has Unauthenticated Remote Code Execution via Public Flow Build EndpointCVE-2026-33017In KEVPublic exploitFix availableEPSS 96.4%9.3 Critical
- langflowLangflow has Remote Code Execution in CSV AgentCVE-2026-27966Public exploitEPSS 35.2%9.8 Critical
- langflowLangflow Disk Cache Deserialization of Untrusted Data Remote Code Execution VulnerabilityCVE-2026-07727.5 High
- langflowLangflow PythonFunction Code Injection Remote Code Execution VulnerabilityCVE-2026-07717.1 High
- langflowLangflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution VulnerabilityCVE-2026-0770In KEVPublic exploitEPSS 62.6%9.8 Critical
- langflowLangflow eval_custom_component_code Eval Injection Remote Code Execution VulnerabilityCVE-2026-0769Public exploitEPSS 41.2%9.8 Critical
- langflowLangflow code Code Injection Remote Code Execution VulnerabilityCVE-2026-0768Public exploitEPSS 28.1%9.8 Critical
- langflowLangflow Missing Authentication on Critical API EndpointsCVE-2026-21445Fix availableEPSS 33.3%8.8 High
- langflowLangflow Vulnerable to External Control of File Name or PathCVE-2025-68478Fix available7.1 High
- langflowLangflow vulnerable to Server-Side Request ForgeryCVE-2025-68477Fix available7.7 High
- langflowLangflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCECVE-2025-34291In KEVPublic exploitFix availableEPSS 93.2%9.4 Critical
- langflowLangflow Vulnerable to Privilege Escalation via CLI Superuser CreationCVE-2025-57760Fix available8.8 High
- langflowLangflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/codeCVE-2025-3248In KEVPublic exploitFix availableEPSS 100.0%9.8 Critical
- langflowLangflow vulnerable to remote code executionCVE-2024-48061Public exploit9.8 Critical
- langflowlangflow has vulnerability in PythonCodeTool componentCVE-2024-428359.8 Critical
- langflowLangflow HTTP POST Request utils.py redosCVE-2024-92775.1 Medium
- langflowLangflow Privilege EscalationCVE-2024-7297EPSS 21.2%8.8 High
- langflowLangflow remote code execution vulnerabilityCVE-2024-37014Fix availableEPSS 63.7%9.8 Critical