IBM Langflow OSS

• CVE-2026-19295 Critical 9.9 Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement 1.6%
• CVE-2026-19294 Medium 6.4 Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities 0.3%
• CVE-2026-19286 Critical 9.8 Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement 0.9%
• CVE-2026-18904 High 8.2 Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities 0.4%
• CVE-2026-18899 High 7.5 Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities 0.7%
• CVE-2026-18891 High 8.2 Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities 0.5%
• CVE-2026-18729 High 8.8 Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement 1.6%
• CVE-2026-18545 Medium 4.3 Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities 0.3%
• CVE-2026-19875 High 7.5 Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow 0.5%
• CVE-2026-19297 Critical 9.1 Insufficient Authentication Brute Force Protection on Login Endpoint 0.6%
• CVE-2026-17624 High 8.5 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling 0.7%
• CVE-2026-17633 High 8.5 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling 0.7%
• CVE-2026-17632 High 8.8 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling 0.9%
• CVE-2026-9196 High 8.1 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling 0.5%
• CVE-2026-8182 High 8.8 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling 0.7%
• CVE-2026-9201 High 8.8 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling 0.4%
• CVE-2026-8478 High 8.8 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling 0.6%
• CVE-2026-8183 High 7.7 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement 0.6%
• CVE-2026-7658 Medium 6.5 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement 0.5%
• CVE-2026-9130 High 7.1 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement 0.3%
• CVE-2026-10547 Medium 5.9 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement 0.4%
• CVE-2026-7869 Medium 5.4 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement 0.3%
• CVE-2026-8470 High 7.4 Langflow is affected by weaknesses in secret handling and sensitive configuration access 0.1%
• CVE-2026-9205 High 7.4 Langflow is affected by weaknesses in secret handling and sensitive configuration access 0.3%
• CVE-2026-10128 Medium 6.5 Langflow is affected by weaknesses in secret handling and sensitive configuration access 0.3%
• CVE-2026-9081 High 7.1 Langflow OSS is affected by server-side request forgery in provider validation and API request functionality 0.3%
• CVE-2026-7657 Medium 6.5 Langflow OSS is affected by server-side request forgery in provider validation and API request functionality 0.4%
• CVE-2026-17625 High 7.2 Langflow is affected by OS Command Injection in Model Context Protocol features 0.8%
• CVE-2026-17623 High 8.8 Langflow is affected OS Command Injection in Model Context Protocol features 0.8%
• CVE-2026-17630 High 7.2 Langflow is affected by security vulnerabilities in Model Context Protocol features 0.8%
• CVE-2026-17626 High 8.8 Langflow is affected by security vulnerabilities in Model Context Protocol features 0.4%
• CVE-2026-8446 High 7.5 Langflow is affected by security vulnerabilities in Model Context Protocol features 0.5%
• CVE-2026-7646 Medium 6.5 Langflow is affected by security vulnerabilities in Model Context Protocol features 0.5%
• CVE-2026-9077 High 8.5 Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features 0.4%
• CVE-2026-12946 Critical 9.9 Remote Code Execution in CUGA Component CodeAgent 0.6%
• CVE-2026-13444 High 8.1 Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints 0.4%
• CVE-2026-10700 Medium 6.5 Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed Unauthorized Access to User Files 0.5%
• CVE-2026-13435 Critical 9.9 Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure 0.5%
• CVE-2026-12942 High 7.5 Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpoints 0.6%
• CVE-2026-12945 High 7.1 Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints 0.4%
• CVE-2026-12940 Critical 9.8 Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints 0.9%
• CVE-2026-13442 High 7.1 Langflow is affected by NET Misconfiguration: Use of Impersonation due to multiple unauthenticated and insufficiently authorized API endpoints 0.3%
• CVE-2026-13445 High 8.1 Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints 0.4%
• CVE-2026-13446 Critical 9.8 Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints 0.4%
• CVE-2026-13448 High 8.1 Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints 0.7%
• CVE-2026-14499 High 8.8 Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints 0.7%
• CVE-2026-7667 High 8.8 Path Traversal Vulnerability in API Request Component Content-Disposition Header Processing 0.6%
• CVE-2026-7754 High 7.7 SSRF Protection Configuration Vulnerability 0.3%
• CVE-2026-7755 High 8.8 MCP Server Configuration Validator Bypass via File Upload API 0.7%
• CVE-2026-7872 High 7.5 Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass 0.6%