Langflow
This hub aggregates every CVE we track for Langflow, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
28
CVEs tracked
8
Critical
7
High
2
In CISA KEV
Severity distribution
MEDIUM10CRITICAL8HIGH7LOW3
Monthly trend
0
1
1
0
0
0
0
0
1
0
0
0
1
0
0
0
1
0
0
4
6
5
6
0
2024-082026-07
Latest CVEs
The 15 most recently published vulnerabilities affecting Langflow.
- CVE-2026-48520Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read6.1
- CVE-2026-42867Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint6.5
- CVE-2026-55255Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow9.9
- CVE-2026-48519Langflow: Unauthenticated RCE in Shareable Playgrounds9.6
- CVE-2026-7664Unauthenticated Flow Execution via Webhook Endpoint in Langflow OSS9.8
- CVE-2026-7787Unauthenticated Session History Access via Public Flow Execution7.5
- CVE-2026-7528Unauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSS7.1
- CVE-2026-7524Path Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code Execution9.8
- CVE-2026-42048Langflow: Path Traversal in Langflow Knowledge Bases API9.6
- CVE-2026-7700langflow-ai langflow LambdaFilterComponent lambda_filter.p eval code injection6.3
- CVE-2026-7687langflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injection6.3
- CVE-2026-6542Monitor API allows cross-user read of transaction logs and deletion of build data via flow_id6.5
- CVE-2026-6600langflow-ai langflow Frontend React Component Rendering edit-message.tsx cross site scripting3.5
- CVE-2026-6599langflow-ai langflow Model Context Protocol Configuration API mcp_projects.py install_mcp_config injection6.3
- CVE-2026-6598langflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file4.3
Product normalization is registry-driven with AI assist and human review. How it works