Total
210 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-104339 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 9.8 CRITICAL |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | |||||
| CVE-2026-107328 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 9.9 CRITICAL |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec. | |||||
| CVE-2026-110190 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 6.5 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system. | |||||
| CVE-2026-110192 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 6.5 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials. | |||||
| CVE-2026-110193 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 8.8 HIGH |
| IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server. | |||||
| CVE-2026-110200 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 6.5 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information. | |||||
| CVE-2026-110244 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 8.8 HIGH |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | |||||
| CVE-2026-110245 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 7.5 HIGH |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication. | |||||
| CVE-2026-110309 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 8.8 HIGH |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation. | |||||
| CVE-2026-18894 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 6.5 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code. | |||||
| CVE-2026-77817 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 6.5 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports. | |||||
| CVE-2026-77819 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 6.5 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory. | |||||
| CVE-2026-90991 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 6.5 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling. | |||||
| CVE-2026-34046 | 1 Langflow | 2 Langflow, Langflow-base | 2026-10-26 | N/A | 8.8 HIGH |
| Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/api/v1/flows.py` branched on the `AUTO_LOGIN` setting to decide whether to filter by `user_id`. When `AUTO_LOGIN` was `False` (i.e., authentication was enabled), neither branch enforced an ownership check — the query returned any flow matching the given UUID regardless of who owned it. This allowed any authenticated user to read any other user's flow, including embedded plaintext API keys; modify the logic of another user's AI agents, and/or delete flows belonging to other users. The vulnerability was introduced by the conditional logic that was meant to accommodate public/example flows (those with `user_id = NULL`) under auto-login mode, but inadvertently left the authenticated path without an ownership filter. The fix in version 1.5.1 removes the `AUTO_LOGIN` conditional entirely and unconditionally scopes the query to the requesting user. | |||||
| CVE-2026-6542 | 1 Langflow | 1 Langflow | 2026-10-26 | N/A | 6.5 MEDIUM |
| IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flow_id to read transaction logs and vertex build data belonging to other users, and to delete persisted vertex build data for another user's flow. | |||||
| CVE-2026-48520 | 1 Langflow | 1 Langflow | 2026-10-26 | N/A | 6.1 MEDIUM |
| Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the "Shareable Playground" (or "Public Flows" in code) contains a potential arbitrary file-read vulnerability, depending on the exact flow configuration used. By making a flow public, public execution of the flow is allowed. The execution request can contain a list of files that gets read by Langflow and fed into the LLM. The files path can be any path supported by the storage - it can be either a local file or S3 path if supported by the local configuration This vulnerability is fixed in 1.10.0. | |||||
| CVE-2026-33760 | 1 Langflow | 1 Langflow | 2026-10-26 | N/A | 8.8 HIGH |
| Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources — messages, sessions, build artifacts, and LLM transaction logs — without verifying that the authenticated requester owns the targeted resource. Any authenticated user can read, modify, rename, or permanently delete another user's data by supplying the target's resource ID or flow_id. This is a classic IDOR/BOLA vulnerability. Notably, the same source file (monitor.py) contains one correctly-implemented endpoint that uses an ownership check, demonstrating the correct pattern was known but inconsistently applied. This vulnerability is fixed in 1.9.0. | |||||
| CVE-2026-48519 | 1 Langflow | 1 Langflow | 2026-10-26 | N/A | 9.6 CRITICAL |
| Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link. Specifically, it enables the route /api/v1/build_public_tmp to execute any public flow, given a public flow ID. When the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload. The vulnerable field is data.nodes[X].data.node.template.code.value. This vulnerability is fixed in 1.9.2. | |||||
| CVE-2026-7787 | 1 Langflow | 1 Langflow | 2026-10-26 | N/A | 7.5 HIGH |
| IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references. | |||||
| CVE-2026-42867 | 1 Langflow | 1 Langflow | 2026-10-26 | N/A | 6.5 MEDIUM |
| Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem. This vulnerability is fixed in 1.9.0. | |||||