LA
Product
langflow
On CISA KEVExploited in the wildRansomware-linked
29
CVEs
3
On KEV
9.9
Max CVSS
6
New 30D
Severity mix
Critical 11High 10Medium 8Low 0
Watch
Add langflow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-42867 | 6.5 | Jun 23 | Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint Affected: < 1.9.0 |
| CVE-2026-5025 | 6.5 | Mar 27 | Langflow - Application Logs Exposed to All Authenticated Users Affected: 0 |
| CVE-2026-48520 | 6.1 | Jun 23 | Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read Affected: < 1.10.0 |
| CVE-2026-55423 | 6.1 | Jun 23 | Langflow: Logout button does not clear session Affected: < 1.7.0 |
| CVE-2026-105698 | 5.4 | Oct 5 | Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints Affected: >= 1.0.0, < 1.10.1 |
| CVE-2026-5026 | 5.4 | Mar 27 | Langflow - Stored XSS via Malicious SVG Upload Affected: 0 |
| CVE-2026-5022 | 5.3 | Mar 27 | Langflow - Missing Authorization on download_image Endpoint Affected: 0 |
| CVE-2026-101861 | 4.1 | Sep 28 | Langflow Code Execution via eval() in Component Input Schema Affected: 1.0.16 before 1.12.0; 0.0.94 before 1.12.0 |
Showing 8