IBM Langflow OSS

• CVE-2026-8056 High 8.8 Parameter Injection Vulnerability in API Graph Execution Engine 0.5%
• CVE-2026-8476 Critical 9.9 Disk Cache Deserialization Remote Code Execution Vulnerability 1.0%
• CVE-2026-8481 Critical 9.9 Remote Code Execution via Code Validation Endpoint 0.9%
• CVE-2026-8505 Critical 9.8 Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution 0.9%
• CVE-2026-8635 Critical 9.9 Arbitrary Code Execution in Python Interpreter Component 0.6%
• CVE-2026-8859 Critical 9.9 Path Traversal in APIRequest Component via Content-Disposition Header 0.6%
• CVE-2026-9103 Critical 9.8 Unauthenticated Superuser Token Issuance via Auto-Login Endpoint 3.2%
• CVE-2026-9135 Critical 9.9 Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation 0.8%
• CVE-2026-9202 Critical 9.8 Unauthenticated User Registration Could Lead to Remote Code Execution 0.5%
• CVE-2026-10129 High 8.5 SSRF via HTTP Redirect Following in Langflow API Request Component 0.3%
• CVE-2026-10134 Critical 10.0 Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows 2.3%
• CVE-2026-10140 Critical 9.6 Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem 0.4%
• CVE-2026-10546 High 7.1 DNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL Component 0.2%
• CVE-2026-10560 High 8.2 Unauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSS 0.5%
• CVE-2026-10564 High 8.2 SSRF Vulnerability in Langflow OSS Legacy Components Bypasses Protection 0.4%
• CVE-2026-7663 Critical 9.1 Unauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization Bypass 0.5%
• CVE-2026-7803 Critical 9.8 Flow Validation Bypass via Empty Component Type Field 0.6%
• CVE-2026-7871 Critical 9.8 Insecure Deserialization in Redis Cache Backend 0.7%
• CVE-2026-7873 Critical 9.9 Code Injection Vulnerability in Code Validation Endpoint 6.2%
• CVE-2026-7874 Critical 9.1 Weak Cryptographic Key Derivation Exposed All Stored Credentials 0.3%
• CVE-2026-7664 Critical 9.8 Unauthenticated Flow Execution via Webhook Endpoint in Langflow OSS 0.5%
• CVE-2026-10561 Critical 10.0 Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection 0.8%
• CVE-2026-7787 High 7.5 Unauthenticated Session History Access via Public Flow Execution 0.2%
• CVE-2026-7528 High 7.1 Unauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSS 0.3%
• CVE-2026-7524 Critical 9.8 Path Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code Execution 0.8%
• CVE-2026-6542 Medium 6.5 Monitor API allows cross-user read of transaction logs and deletion of build data via flow_id 0.2%