LA
Product
langflow
On CISA KEVExploited in the wildRansomware-linked
30
CVEs
3
On KEV
9.9
Max CVSS
6
New 30D
Severity mix
Critical 12High 10Medium 8Low 0
Watch
Add langflow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-55255 In wildKEV | 8.4 | Jun 23 | Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow Affected: < 1.9.1 |
| CVE-2026-33760 | 8.8 | Jun 23 | Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints Affected: < 1.9.0 |
| CVE-2026-34046 | 8.8 | Mar 27 | Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check Affected: < 1.5.1 |
| CVE-2026-5027 | 8.8 | Mar 27 | Langflow - Path Traversal Arbitrary File Write via upload_user_file Affected: 0 |
| CVE-2026-33053 | 8.8 | Mar 20 | Langflow has Missing Ownership Verification in API Key Deletion (IDOR) Affected: < 1.9.0 |
| CVE-2026-55446 | 7.5 | Jun 23 | Langflow: Unauthenticated DoS through multipart form boundary file upload Affected: < 1.0.19 |
| CVE-2026-33497 | 7.5 | Mar 24 | Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading Affected: < 1.7.1 |
| CVE-2026-33484 | 7.5 | Mar 24 | Langflow has Unauthenticated IDOR on Image Downloads Affected: >= 1.0.0, < 1.9.0 |
| CVE-2026-105741 | 7.1 | Oct 5 | Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write Affected: >= 1.5.0, < 1.10.3 |
| CVE-2026-105699 | 7.1 | Oct 5 | Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers Affected: >= 1.6.8, <= 1.9.0 |
Showing 10