Skip to contentLangflow vulnerabilities
Newest
- ibm langflow oss, langflow +1 moreDisk Cache Deserialization Remote Code Execution VulnerabilityCVE-2026-84769.9 Critical
- ibm langflow oss, langflow +1 moreRemote Code Execution via Code Validation EndpointCVE-2026-84819.9 Critical
- ibm langflow oss, langflow +1 moreAuthentication Bypass in Webhook Endpoints Allowed Unauthorized Flow ExecutionCVE-2026-8505Fix available9.8 Critical
- ibm langflow oss, langflow +1 moreArbitrary Code Execution in Python Interpreter ComponentCVE-2026-86359.9 Critical
- ibm langflow oss, langflow +1 morePath Traversal in APIRequest Component via Content-Disposition HeaderCVE-2026-88599.9 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated Superuser Token Issuance via Auto-Login EndpointCVE-2026-91039.8 Critical
- ibm langflow oss, langflow +1 morePolicies Component Dynamic CodeInput Fields Bypass Custom Component ValidationCVE-2026-91359.9 Critical
- ibm langflow, langflow oss +1 moreUnauthenticated Remote Code Execution via Auto-Login Bypass and Code ValidationCVE-2026-9198In KEVPublic exploitEPSS 28.7%9.8 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated User Registration Could Lead to Remote Code ExecutionCVE-2026-92029.8 Critical
- ibm langflow oss, langflow +1 moreSSRF via HTTP Redirect Following in Langflow API Request ComponentCVE-2026-101298.5 High
- ibm langflow oss, langflow +1 moreUnauthenticated Server-Side RCE via PythonCodeStructuredTool in Public FlowsCVE-2026-10134Public exploit10.0 Critical
- ibm langflow oss, langflow +1 moreCross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode SubsystemCVE-2026-101409.6 Critical
- ibm langflow oss, langflow +1 moreDNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL ComponentCVE-2026-105467.1 High
- ibm langflow oss, langflow +1 moreUnauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSSCVE-2026-105608.2 High
- ibm langflow oss, langflow +1 moreSSRF Vulnerability in Langflow OSS Legacy Components Bypasses ProtectionCVE-2026-105648.2 High
- ibm langflow oss, langflow +1 moreUnauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization BypassCVE-2026-76639.1 Critical
- ibm langflow oss, langflow +1 moreFlow Validation Bypass via Empty Component Type FieldCVE-2026-78039.8 Critical
- ibm langflow oss, langflow +1 moreInsecure Deserialization in Redis Cache BackendCVE-2026-78719.8 Critical
- ibm langflow oss, langflow +1 moreCode Injection Vulnerability in Code Validation EndpointCVE-2026-7873Public exploitFix available9.9 Critical
- ibm langflow oss, langflow +1 moreWeak Cryptographic Key Derivation Exposed All Stored CredentialsCVE-2026-78749.1 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated Flow Execution via Webhook Endpoint in Langflow OSSCVE-2026-76649.8 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins InjectionCVE-2026-10561Fix available10.0 Critical
- langflowlangflow-ai langflow Bundle URL Loader code injectionCVE-2026-128224.8 Medium
- langflowLangflow: BaseFileComponent-based nodes arbitrary file read with RCE exploitCVE-2026-55447Fix available9.6 Critical
- langflowLangflow: Unauthenticated DoS through multipart form boundary file uploadCVE-2026-55446Fix available7.5 High
- langflowLangflow: Logout button does not clear sessionCVE-2026-55423Fix available6.1 Medium
- langflowLangflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's FlowCVE-2026-55255In KEVPublic exploitFix available8.4 High
- langflowLangflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leakCVE-2026-55450Public exploitFix available9.3 Critical
- langflowLangflow: Unauthenticated Shareable Playground arbitrary local or S3 file readCVE-2026-48520Fix available6.1 Medium
- langflowLangflow: Unauthenticated RCE in Shareable PlaygroundsCVE-2026-48519Public exploitFix available9.6 Critical
- langflowLangflow: Path Traversal in Knowledge Bases API via Creation EndpointCVE-2026-42867Fix available6.5 Medium
- langflowLangflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 EndpointsCVE-2026-33760Fix available8.8 High
- ibm langflow desktop, langflow desktop +1 moreIBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal ServicesCVE-2026-33415.4 Medium
- ibm langflow oss, langflow +1 moreUnauthenticated Session History Access via Public Flow ExecutionCVE-2026-77877.5 High
- ibm langflow oss, langflow +1 moreUnauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSSCVE-2026-75287.1 High
- ibm langflow oss, langflow +1 morePath Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code ExecutionCVE-2026-75249.8 Critical
- langflowLangflow: Path Traversal in Langflow Knowledge Bases APICVE-2026-42048Public exploitFix available9.6 Critical
- ibm langflow oss, langflow +1 moreMonitor API allows cross-user read of transaction logs and deletion of build data via flow_idCVE-2026-65426.5 Medium
- ibm langflow desktop, langflow desktop +1 moreAuthenticated Remote Code Execution Vulnerability in Langflow Code Validation EndpointCVE-2026-65438.8 High
- ibm langflow desktop, langflow desktop +1 morePath Traversal and Arbitrary File Write Vulnerability in IBM Langflow Desktop API v2 File Upload EndpointCVE-2026-33456.5 Medium
- ibm langflow desktop, langflow desktop +1 moreStored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRawCVE-2026-33466.4 Medium
- ibm langflow desktop, langflow desktop +1 moreServer-Side Request Forgery (SSRF) in Langflow URL ComponentCVE-2026-33406.5 Medium
- ibm langflow desktop, langflow desktop +1 moreArbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 APICVE-2026-45026.5 Medium
- ibm langflow desktop, langflow desktop +1 moreUnauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download EndpointCVE-2026-45037.5 High
- ibm langflow desktop, langflow +1 moreIBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle fileCVE-2026-33578.8 High
- langflow, langflow langflow-base +1 moreLangflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership CheckCVE-2026-34046Fix available8.7 High
- langflowLangflow - Path Traversal Arbitrary File Write via upload_user_fileCVE-2026-5027Public exploitEPSS 40.7%8.8 High
- langflowLangflow - Stored XSS via Malicious SVG UploadCVE-2026-50267.0 High
- langflowLangflow - Application Logs Exposed to All Authenticated UsersCVE-2026-50256.5 Medium
- langflowLangflow - Missing Authorization on download_image EndpointCVE-2026-50226.3 Medium
- Show moreLoading…