IBM Langflow OSS
176 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-18894 | 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 6.5 | |||
| CVE-2026-77817 | 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 6.5 | |||
| CVE-2026-77819 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 6.5 | |||
| CVE-2026-90991 | 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 6.5 | |||
| CVE-2026-93680 | 1.0.0 – 1.12.8 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.8 | |||
| CVE-2026-102590 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 5.0 | |||
| CVE-2026-103092 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.5 | |||
| CVE-2026-101288 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | |||
| CVE-2026-104308 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 4.3 | |||
| CVE-2026-104309 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 6.5 | |||
| CVE-2026-104310 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 4.3 | |||
| CVE-2026-104312 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | LOW 3.5 | |||
| CVE-2026-104314 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 6.5 | |||
| CVE-2026-104315 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 4.3 | |||
| CVE-2026-104316 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 6.5 | |||
| CVE-2026-104317 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.1 | |||
| CVE-2026-104324 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | |||
| CVE-2026-104328 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | |||
| CVE-2026-104331 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 5.4 | |||
| CVE-2026-104339 | 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.8 | |||
| CVE-2026-107326 | 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | |||
| CVE-2026-107327 | 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.9 | |||
| CVE-2026-107328 | 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.9 | |||
| CVE-2026-107329 | 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.9 | |||
| CVE-2026-110186 | 1.0.0 – 1.12.8 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.8 | |||
| CVE-2026-110190 | 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 6.5 | |||
| CVE-2026-110192 | 1.0.0 – 1.12.8 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 6.5 | |||
| CVE-2026-110193 | 1.0.0 – 1.12.8 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | |||
| CVE-2026-110196 | 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | |||
| CVE-2026-110200 | 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 6.5 | |||
| CVE-2026-110244 | 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | |||
| CVE-2026-110245 | 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | HIGH 7.5 | |||
| CVE-2026-110309 | 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | |||
| CVE-2026-107366 | 1.0.0 – 1.12.4 | Langflow OSS Authorization Bypass Through User-Controlled Key | HIGH 8.3 | 0.3 % | ||
| CVE-2026-88962 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | 0.7 % | ||
| CVE-2026-93443 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | 0.4 % | ||
| CVE-2026-93448 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-93449 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | 0.4 % | ||
| CVE-2026-93445 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | 0.4 % | ||
| CVE-2026-93447 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 7.5 | 0.3 % | ||
| CVE-2026-93675 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-93677 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 7.7 | 0.3 % | ||
| CVE-2026-93678 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 7.6 | 0.3 % | ||
| CVE-2026-93679 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-93674 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.8 | 15 % | ||
| CVE-2026-97671 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-97673 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | 0.6 % | ||
| CVE-2026-97674 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.1 | 0.3 % | ||
| CVE-2026-97678 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | 0.6 % | ||
| CVE-2026-97679 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | 0.7 % | ||
| CVE-2026-97680 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.3 | 0.3 % | ||
| CVE-2026-97655 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | 0.8 % | ||
| CVE-2026-97676 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | 0.7 % | ||
| CVE-2026-101329 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-101331 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 7.7 | 0.3 % | ||
| CVE-2026-103360 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.1 | 0.5 % | ||
| CVE-2026-104334 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.8 | 0.7 % | ||
| CVE-2026-104335 | 1.0.0 – 1.12.2 | Langflow OSS is affected by multiple vulnerabilities | HIGH 8.8 | 0.9 % | ||
| CVE-2026-12944 | 1.0.0 – 1.10.0 | Incomplete Security Scanner Blocklist Enables Network-Based Code Execution | CRITICAL 9.6 | 0.4 % | ||
| CVE-2026-12763 | 1.0.0 – 1.11.5 | Langflow is vulnerable to authentication bypass and insufficient session expiration | MEDIUM 4.2 | 0.2 % | ||
| CVE-2026-12765 | 1.0.0 – 1.10.2 | Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-12766 | 1.0.0 – 1.11.2 | Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-12767 | 1.0.0 – 1.11.5 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-17628 | 1.0.0 – 1.10.2 | Langflow is affected by improper authentication due to missing password verification in the password reset endpoint | MEDIUM 5.4 | 0.4 % | ||
| CVE-2026-76059 | 1.0.0 – 1.11.5 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards | HIGH 8.8 | 0.7 % | ||
| CVE-2026-78569 | 1.0.0 – 1.11.5 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards | HIGH 8.8 | 0.7 % | ||
| CVE-2026-78571 | 1.0.0 – 1.11.5 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards | HIGH 8.8 | 0.8 % | ||
| CVE-2026-78575 | 1.0.0 – 1.11.5 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards | HIGH 8.8 | 0.8 % | ||
| CVE-2026-79723 | 1.0.0 – 1.11.5 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches | MEDIUM 5.0 | 0.4 % | ||
| CVE-2026-79724 | 1.0.0 – 1.11.5 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards | CRITICAL 9.8 | 0.7 % | ||
| CVE-2026-79725 | 1.0.0 – 1.11.5 | Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-79742 | 1.0.0 – 1.11.5 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards | HIGH 8.8 | 0.8 % | ||
| CVE-2026-81204 | 1.0.0 – 1.11.5 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards | CRITICAL 9.8 | 0.9 % | ||
| CVE-2026-81211 | 1.0.0 – 1.11.5 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards | HIGH 8.8 | 0.6 % | ||
| CVE-2026-81941 | 1.0.0 – 1.11.5 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards | HIGH 8.8 | 0.6 % | ||
| CVE-2026-81213 | 1.0.0 – 1.11.5 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches | HIGH 8.6 | 0.5 % | ||
| CVE-2026-81265 | 1.0.0 – 1.11.5 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches | HIGH 7.5 | 0.4 % | ||
| CVE-2026-81268 | 1.0.0 – 1.11.5 | Langflow is vulnerable to authentication bypass and insufficient session expiration | HIGH 8.1 | 0.4 % | ||
| CVE-2026-81940 | 1.0.0 – 1.11.5 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards | HIGH 8.8 | 0.8 % | ||
| CVE-2026-84889 | 1.0.0 – 1.10.3 | A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on… | HIGH 8.8 | 0.9 % | ||
| CVE-2026-85025 | 1.0.0 – 1.11.5 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-9225 | 1.0.0 – 1.11.5 | Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-14470 | 1.0.0 – 1.10.2 | Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-17627 | 1.0.0 – 1.10.2 | Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint | HIGH 7.1 | 0.3 % | ||
| CVE-2026-17621 | 1.0.0 – 1.10.2 | Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components | MEDIUM 5.4 | 0.4 % | ||
| CVE-2026-17622 | 1.0.0 – 1.10.2 | Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components | MEDIUM 6.5 | 0.7 % | ||
| CVE-2026-17631 | 1.0.0 – 1.10.2 | Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-19298 | 1.0.0 – 1.11.2 | Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpoint | HIGH 8.8 | 0.9 % | ||
| CVE-2026-19301 | 1.0.0 – 1.11.2 | Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-19303 | 1.0.0 – 1.11.2 | Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components | HIGH 8.1 | 0.6 % | ||
| CVE-2026-19300 | 1.0.0 – 1.11.2 | Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows | HIGH 7.5 | 0.5 % | ||
| CVE-2026-19299 | 1.0.0 – 1.11.2 | Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components | MEDIUM 6.5 | 0.7 % | ||
| CVE-2026-19302 | 1.0.0 – 1.11.2 | Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components | MEDIUM 6.5 | 0.7 % | ||
| CVE-2026-19304 | 1.0.0 – 1.11.2 | Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components | HIGH 7.7 | 0.4 % | ||
| CVE-2026-19305 | 1.0.0 – 1.11.2 | Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components | HIGH 8.6 | 0.5 % | ||
| CVE-2026-19306 | 1.0.0 – 1.11.2 | Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components | HIGH 7.7 | 0.5 % | ||
| CVE-2026-9138 | 1.0.0 – 1.11.2 | Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-8447 | 1.0.0 – 1.11.2 | Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-9186 | 1.0.0 – 1.11.2 | Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-19295 | 1.0.0 – 1.11.1 | Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement | CRITICAL 9.9 | 1.6 % | ||
| CVE-2026-19294 | 1.0.0 – 1.11.1 | Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-19286 | 1.0.0 – 1.11.1 | Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement | CRITICAL 9.8 | 0.9 % | ||
| CVE-2026-18904 | 1.0.0 – 1.11.1 | Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities | HIGH 8.2 | 0.4 % | ||
| CVE-2026-18899 | 1.0.0 – 1.11.1 | Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities | HIGH 7.5 | 0.7 % | ||
| CVE-2026-18891 | 1.0.0 – 1.11.1 | Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities | HIGH 8.2 | 0.5 % | ||
| CVE-2026-18729 | 1.0.0 – 1.11.1 | Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement | HIGH 8.8 | 1.6 % | ||
| CVE-2026-18545 | 1.0.0 – 1.11.1 | Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-19875 | 1.0.0 – 1.10.0 | Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow | HIGH 7.5 | 0.5 % | ||
| CVE-2026-19297 | 1.0.0 – 1.9.6 | Insufficient Authentication Brute Force Protection on Login Endpoint | CRITICAL 9.1 | 0.6 % | ||
| CVE-2026-17624 | 1.0.0 – 1.10.3 | Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling | HIGH 8.8 | 0.7 % | ||
| CVE-2026-17633 | 1.0.0 – 1.10.3 | Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling | HIGH 8.8 | 0.7 % | ||
| CVE-2026-17632 | 1.0.0 – 1.10.3 | Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling | HIGH 8.8 | 0.9 % | ||
| CVE-2026-9196 | 1.0.0 – 1.10.3 | Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling | HIGH 8.8 | 0.5 % | ||
| CVE-2026-8182 | 1.0.0 – 1.10.3 | Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling | HIGH 8.8 | 0.7 % | ||
| CVE-2026-9201 | 1.0.0 – 1.10.3 | Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling | HIGH 8.8 | 0.4 % | ||
| CVE-2026-8478 | 1.0.0 – 1.10.3 | Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling | HIGH 8.8 | 0.6 % | ||
| CVE-2026-8183 | 1.0.0 – 1.10.3 | Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement | HIGH 7.7 | 0.6 % | ||
| CVE-2026-7658 | 1.0.0 – 1.10.3 | Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-9130 | 1.0.0 – 1.10.3 | Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement | HIGH 7.1 | 0.3 % | ||
| CVE-2026-10547 | 1.0.0 – 1.10.3 | Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement | HIGH 8.1 | 0.4 % | ||
| CVE-2026-7869 | 1.0.0 – 1.10.3 | Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-8470 | 1.0.0 – 1.10.3 | Langflow is affected by weaknesses in secret handling and sensitive configuration access | CRITICAL 9.1 | 0.1 % | ||
| CVE-2026-9205 | 1.0.0 – 1.10.3 | Langflow is affected by weaknesses in secret handling and sensitive configuration access | CRITICAL 9.8 | 0.3 % | ||
| CVE-2026-10128 | 1.0.0 – 1.10.3 | Langflow is affected by weaknesses in secret handling and sensitive configuration access | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-9081 | 1.0.0 – 1.10.3 | Langflow OSS is affected by server-side request forgery in provider validation and API request functionality | HIGH 7.1 | 0.3 % | ||
| CVE-2026-7657 | 1.0.0 – 1.10.3 | Langflow OSS is affected by server-side request forgery in provider validation and API request functionality | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-17625 | 1.0.0 – 1.10.3 | Langflow is affected by OS Command Injection in Model Context Protocol features | HIGH 8.8 | 0.8 % | ||
| CVE-2026-17623 | 1.0.0 – 1.10.3 | Langflow is affected OS Command Injection in Model Context Protocol features | HIGH 8.8 | 0.8 % | ||
| CVE-2026-17630 | 1.0.0 – 1.10.3 | Langflow is affected by security vulnerabilities in Model Context Protocol features | HIGH 8.8 | 0.8 % | ||
| CVE-2026-17626 | 1.0.0 – 1.10.3 | Langflow is affected by security vulnerabilities in Model Context Protocol features | HIGH 8.8 | 0.4 % | ||
| CVE-2026-8446 | 1.0.0 – 1.10.3 | Langflow is affected by security vulnerabilities in Model Context Protocol features | HIGH 7.5 | 0.5 % | ||
| CVE-2026-7646 | 1.0.0 – 1.10.3 | Langflow is affected by security vulnerabilities in Model Context Protocol features | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-9077 | 1.0.0 – 1.10.3 | Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features | HIGH 8.5 | 0.4 % | ||
| CVE-2026-12946 | 1.0.0 – 1.10.0 | Remote Code Execution in CUGA Component CodeAgent | CRITICAL 9.9 | 0.6 % | ||
| CVE-2026-13444 | 1.0.0 – 1.10.1 | Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated… | HIGH 8.1 | 0.4 % | ||
| CVE-2026-10700 | 1.0.0 – 1.8.4 | Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed Unauthorized Access to User Files | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-13435 | 1.0.0 – 1.10.1 | Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure | CRITICAL 9.9 | 0.5 % | ||
| CVE-2026-12942 | 1.0.0 – 1.10.1 | Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpoints | HIGH 7.5 | 0.6 % | ||
| CVE-2026-12945 | 1.0.0 – 1.10.1 | Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints | HIGH 7.1 | 0.4 % | ||
| CVE-2026-12940 | 1.0.0 – 1.10.1 | Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints | CRITICAL 9.8 | 0.9 % | ||
| CVE-2026-13442 | 1.0.0 – 1.10.1 | Langflow is affected by NET Misconfiguration: Use of Impersonation due to multiple unauthenticated and insufficiently authorized API endp… | HIGH 7.1 | 0.3 % | ||
| CVE-2026-13445 | 1.0.0 – 1.10.1 | Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated… | HIGH 8.1 | 0.4 % | ||
| CVE-2026-13446 | 1.0.0 – 1.10.1 | Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated… | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-13448 | 1.0.0 – 1.10.1 | Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated… | CRITICAL 9.8 | 0.7 % | ||
| CVE-2026-14499 | 1.0.0 – 1.10.1 | Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated… | HIGH 8.8 | 0.7 % | ||
| CVE-2026-7667 | 1.0.0 – 1.10.0 | Path Traversal Vulnerability in API Request Component Content-Disposition Header Processing | HIGH 8.8 | 0.6 % | ||
| CVE-2026-7754 | 1.0.0 – 1.10.0 | SSRF Protection Configuration Vulnerability | HIGH 7.7 | 0.3 % | ||
| CVE-2026-7755 | 1.0.0 – 1.10.0 | MCP Server Configuration Validator Bypass via File Upload API | HIGH 8.8 | 0.7 % | ||
| CVE-2026-7872 | 1.0.0 – 1.10.0 | Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass | HIGH 8.1 | 0.6 % | ||
| CVE-2026-8056 | 1.0.0 – 1.10.0 | Parameter Injection Vulnerability in API Graph Execution Engine | HIGH 8.8 | 0.5 % | ||
| CVE-2026-8476 | 1.0.0 – 1.10.0 | Disk Cache Deserialization Remote Code Execution Vulnerability | CRITICAL 9.9 | 1.0 % | ||
| CVE-2026-8481 | 1.0.0 – 1.10.0 | Remote Code Execution via Code Validation Endpoint | CRITICAL 9.9 | 0.9 % | ||
| CVE-2026-8505 | 1.0.0 – 1.10.0 | Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution | CRITICAL 9.8 | 0.7 % | ||
| CVE-2026-8635 | 1.0.0 – 1.10.0 | Arbitrary Code Execution in Python Interpreter Component | CRITICAL 9.9 | 0.6 % | ||
| CVE-2026-8859 | 1.0.0 – 1.10.0 | Path Traversal in APIRequest Component via Content-Disposition Header | CRITICAL 9.9 | 0.6 % | ||
| CVE-2026-9103 | 1.0.0 – 1.10.0 | Unauthenticated Superuser Token Issuance via Auto-Login Endpoint | CRITICAL 9.8 | 3.2 % | ||
| CVE-2026-9135 | 1.0.0 – 1.10.0 | Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation | CRITICAL 9.9 | 0.8 % | ||
| CVE-2026-9198 | 1.0.0 – 1.10.0 | Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation | CRITICAL 9.8 | 29 % | KEV | |
| CVE-2026-9202 | 1.0.0 – 1.10.0 | Unauthenticated User Registration Could Lead to Remote Code Execution | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-10129 | 1.0.0 – 1.9.3 | SSRF via HTTP Redirect Following in Langflow API Request Component | HIGH 8.5 | 0.3 % | ||
| CVE-2026-10134 | 1.0.0 – 1.9.3 | Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows | CRITICAL 10.0 | 2.3 % | ||
| CVE-2026-10140 | 1.0.0 – 1.10.0 | Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem | CRITICAL 9.6 | 0.4 % | ||
| CVE-2026-10546 | 1.0.0 – 1.9.3 | DNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL Component | HIGH 7.1 | 0.2 % | ||
| CVE-2026-10560 | 1.0.0 – 1.9.6 | Unauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSS | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-10564 | 1.0.0 – 1.9.6 | SSRF Vulnerability in Langflow OSS Legacy Components Bypasses Protection | HIGH 8.2 | 0.4 % | ||
| CVE-2026-7663 | 1.0.0 – 1.9.6 | Unauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization Bypass | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-7803 | 1.0.0 – 1.10.0 | Flow Validation Bypass via Empty Component Type Field | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-7871 | 1.0.0 – 1.10.0 | Insecure Deserialization in Redis Cache Backend | CRITICAL 9.8 | 0.7 % | ||
| CVE-2026-7873 | 1.0.0 – 1.10.0 | Code Injection Vulnerability in Code Validation Endpoint | CRITICAL 9.9 | 1.6 % | ||
| CVE-2026-7874 | 1.0.0 – 1.10.0 | Weak Cryptographic Key Derivation Exposed All Stored Credentials | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-7664 | 1.0.0 – 1.8.4 | Unauthenticated Flow Execution via Webhook Endpoint in Langflow OSS | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-10561 | 1.0.0 – 1.9.3 | Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection | CRITICAL 10.0 | 0.8 % | ||
| CVE-2026-7787 | 1.0.0 – 1.9.1 | Unauthenticated Session History Access via Public Flow Execution | HIGH 8.1 | 0.2 % | ||
| CVE-2026-7528 | 1.0.0 – 1.9.0 | Unauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSS | HIGH 7.5 | 0.3 % | ||
| CVE-2026-7524 | 1.0.0 – 1.9.1 | Path Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code Execution | CRITICAL 9.8 | 0.8 % | ||
| CVE-2026-6542 | 1.0.0 – 1.8.4 | Monitor API allows cross-user read of transaction logs and deletion of build data via flow_id | HIGH 8.1 | 0.2 % |