Langflow

Records237All Threatist records

Exploited (KEV)6In CISA KEV

CVSS critical64CVSS 9.0–10.0

CVSS high107CVSS 7.0–8.9

Exploited now

Langflow records in CISA KEV

TI-2026-08085 IBM Langflow Code Injection Vulnerability CRITICAL 100KEV 2026-08-04 TI-2026-00553 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability CRITICAL 100KEV 2026-07-21 TI-2026-39928 Langflow Authorization Bypass Through User-Controlled Key Vulnerability CRITICAL 96KEV 2026-07-07 TI-2025-24427 Langflow Origin Validation Error Vulnerability CRITICAL 100KEV 2026-05-21 TI-2026-25463 Langflow Code Injection Vulnerability CRITICAL 99KEV 2026-03-25 TI-2025-02845 Langflow Missing Authentication Vulnerability CRITICAL 100KEV 2025-05-05

Components

Products in the NVD configurations · select one to filter the records

Langflow 217 records CRITICAL Langflow Desktop 7 records MEDIUM Langflow-base 1 record MEDIUM

Records

7 records in Langflow Desktop · all components

TI-2026-05738 CVE-2026-6543 · GHSA-3qgh-3gr3-38fg

Authenticated Remote Code Execution Vulnerability in Langflow Code Validation Endpoint

MEDIUM 40

IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges of the process running Langflow.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0047 Published 2026-04-30 No fix listed CWE-94

TI-2026-03912 CVE-2026-4503 · GHSA-f8v3-8wm7-h9qr

Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint

LOW 39

IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view other users' images due to an indirect object reference through a user-controlled key.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0034 Published 2026-04-30 No fix listed CWE-639

TI-2026-02883 CVE-2026-3340 · GHSA-6c85-4v28-rfx8

Server-Side Request Forgery (SSRF) in Langflow URL Component

LOW 34

IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vulnerable to server-side request forgery (SSRF).

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00167 Published 2026-04-30 No fix listed CWE-918

TI-2026-03911 CVE-2026-4502 · GHSA-q6r8-4vgg-hrwg

Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API

LOW 29

IBM Langflow Desktop 1.2.0 through 1.8.4 Langflow could allow an authenticated attacker to traverse directories on the system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00275 Published 2026-04-30 No fix listed CWE-22

TI-2026-02888 CVE-2026-3345 · GHSA-c8wg-94jj-9q2x

Path Traversal and Arbitrary File Write Vulnerability in IBM Langflow Desktop API v2 File Upload Endpoint

LOW 29

IBM Langflow Desktop <=1.8.4 Langflow could allow a remote attacker to traverse directories on the system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00374 Published 2026-04-30 No fix listed CWE-22

TI-2026-02889 CVE-2026-3346 · GHSA-m357-46wc-mgw8

Stored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRaw

LOW 28

IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00157 Published 2026-04-30 No fix listed CWE-89

TI-2026-02884 CVE-2026-3341 · GHSA-wvfv-3qjh-qwxj

IBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal Services

LOW 23

IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request forgery (SSRF).

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00138 Published 2026-06-11 No fix listed CWE-918

Open these records in search →