Login Request a demo
LA
Product
langflow
by langflow-ai · last CVE Oct 7, 2026
On CISA KEVExploited in the wildRansomware-linked
184
CVEs
6
On KEV
10.0
Max CVSS
24
New 30D
Vulnerabilities184In the news12Timeline
Severity mix
Critical 53High 87Medium 42Low 2
Severity
All severities184Critical53High87Medium42Low2
Exploitation
On CISA KEV6Exploited in the wild6
Watch

Add langflow to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-9198
In wildKEV
9.8
29%
Jul 17
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
Affected: 1.0.0 before 1.10.1
CVE-2026-33017
In wildKEV
9.8
96%
Mar 20
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
Affected: before 1.8.2
CVE-2026-0770
In wildKEV
9.8
63%
Jan 23
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
Affected: 1.4.2
CVE-2025-3248
RansomwareIn wildKEV
9.8
100%
Apr 7
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
Affected: before 1.3.0
CVE-2025-34291
In wildKEV
8.8
93%
Dec 5
Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
Affected: through 1.6.9
CVE-2026-55255
In wildKEV
8.4
1%
Jun 23
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
Affected: before 1.9.1
Showing 6