langflow-ai langflow

• CVE-2026-55255 High 8.4 Exploited Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow 0.9%
• CVE-2026-33017 Critical 9.3 Exploited Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint 96.4%
• CVE-2025-3248 Critical 9.8 Exploited Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code 100.0%
• CVE-2026-105741 High 7.1 Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write 0.2%
• CVE-2026-105740 Critical 9.9 Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server 3.9%
• CVE-2026-105699 High 7.1 Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers 0.3%
• CVE-2026-105698 Medium 5.4 Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints 0.2%
• CVE-2026-105697 Critical 9.9 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration 0.9%
• CVE-2026-101861 Medium 4.1 Langflow Code Execution via eval() in Component Input Schema 0.2%
• CVE-2026-48520 Medium 6.1 Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read 0.4%
• CVE-2026-33760 High 8.8 Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints 0.5%
• CVE-2026-42867 Medium 6.5 Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint 0.5%
• CVE-2026-55423 Medium 6.1 Langflow: Logout button does not clear session 0.2%
• CVE-2026-55446 High 7.5 Langflow: Unauthenticated DoS through multipart form boundary file upload 0.6%
• CVE-2026-48519 Critical 9.6 Langflow: Unauthenticated RCE in Shareable Playgrounds 0.8%
• CVE-2026-55447 Critical 9.6 Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit 0.7%
• CVE-2026-55450 Critical 9.3 Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak 1.2%
• CVE-2026-12822 Medium 5.3 langflow-ai langflow Bundle URL Loader code injection 0.3%
• CVE-2026-42048 Critical 9.6 Langflow: Path Traversal in Langflow Knowledge Bases API 4.2%
• CVE-2026-7700 Medium 6.3 langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injection 0.3%
• CVE-2026-7687 Medium 6.3 langflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injection 3.0%
• CVE-2026-6600 Low 3.5 langflow-ai langflow Frontend React Component Rendering edit-message.tsx cross site scripting 0.2%
• CVE-2026-6599 Medium 6.3 langflow-ai langflow Model Context Protocol Configuration API mcp_projects.py install_mcp_config injection 0.2%
• CVE-2026-6598 Medium 4.3 langflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file 0.2%
• CVE-2026-6597 Low 2.7 langflow-ai langflow Flow Using API core.py has_api_terms credentials storage 0.4%
• CVE-2026-6596 High 7.3 langflow-ai langflow API Endpoint endpoints.py create_upload_file unrestricted upload 0.3%
• CVE-2026-34046 High 8.7 Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check 0.5%
• CVE-2026-33873 Critical 9.3 Langflow has Authenticated Code Execution in Agentic Assistant Validation 1.5%
• CVE-2026-5027 High 8.8 Langflow - Path Traversal Arbitrary File Write via upload_user_file 40.0%
• CVE-2026-5026 High 7.0 Langflow - Stored XSS via Malicious SVG Upload 0.2%
• CVE-2026-5025 Medium 6.5 Langflow - Application Logs Exposed to All Authenticated Users 0.3%
• CVE-2026-5022 Medium 6.3 Langflow - Missing Authorization on download_image Endpoint 0.2%
• CVE-2026-33497 High 8.7 Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading 19.6%
• CVE-2026-33484 High 7.5 Langflow has Unauthenticated IDOR on Image Downloads 5.9%
• CVE-2026-33475 Critical 9.1 Langflow GitHub Actions Shell Injection 3.2%
• CVE-2026-33309 Critical 10.0 Langflow has an Arbitrary File Write (RCE) via v2 API 13.5%
• CVE-2026-33053 Medium 6.1 Langflow has Missing Ownership Verification in API Key Deletion (IDOR) 0.4%
• CVE-2026-27966 Critical 9.8 Langflow has Remote Code Execution in CSV Agent 35.2%
• CVE-2026-21445 High 8.8 Langflow Missing Authentication on Critical API Endpoints 33.3%
• CVE-2025-68478 High 7.1 Langflow Vulnerable to External Control of File Name or Path 5.8%
• CVE-2025-68477 High 7.7 Langflow vulnerable to Server-Side Request Forgery 6.3%
• CVE-2025-57760 High 8.8 Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation 0.5%