LO
Product
Langflow OSS
On CISA KEVExploited in the wild
175
CVEs
1
On KEV
10.0
Max CVSS
58
New 30D
Severity mix
Critical 43High 81Medium 50Low 1
Watch
Add Langflow OSS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-9138 | 6.5 | Sep 4 | Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components Affected: 1.0.0 through 1.11.2 |
| CVE-2026-9186 | 6.5 | Sep 4 | Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust Affected: 1.0.0 through 1.11.2 |
| CVE-2026-19294 | 6.5 | Aug 28 | Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities Affected: 1.0.0 through 1.11.1 |
| CVE-2026-7658 | 6.5 | Aug 5 | Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement Affected: 1.0.0 through 1.10.3 |
| CVE-2026-10128 | 6.5 | Aug 5 | Langflow is affected by weaknesses in secret handling and sensitive configuration access Affected: 1.0.0 through 1.10.3 |
| CVE-2026-7657 | 6.5 | Aug 5 | Langflow OSS is affected by server-side request forgery in provider validation and API request functionality Affected: 1.0.0 through 1.10.3 |
| CVE-2026-7646 | 6.5 | Aug 5 | Langflow is affected by security vulnerabilities in Model Context Protocol features Affected: 1.0.0 through 1.10.3 |
| CVE-2026-10700 | 6.5 | Jul 30 | Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed Unauthorized Access to User Files Affected: 1.0.0 through 1.8.4 |
| CVE-2026-7754 | 6.5 | Jul 17 | SSRF Protection Configuration Vulnerability Affected: 1.0.0 through 1.10.0 |
| CVE-2026-10546 | 6.5 | Jun 30 | DNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL Component Affected: 1.0.0 through 1.9.3 |
| CVE-2026-8447 | 6.1 | Sep 4 | Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust Affected: 1.0.0 through 1.11.2 |
| CVE-2026-104331 New | 5.4 | Oct 29 | Langflow OSS is affected by multiple vulnerabilities Affected: 1.0.0 through 1.12.3 |
| CVE-2026-12766 | 5.4 | Sep 14 | Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components Affected: 1.0.0 through 1.11.2 |
| CVE-2026-17628 | 5.4 | Sep 14 | Langflow is affected by improper authentication due to missing password verification in the password reset endpoint Affected: 1.0.0 through 1.10.2 |
| CVE-2026-17621 | 5.4 | Sep 4 | Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components Affected: 1.0.0 through 1.10.2 |
| CVE-2026-7869 | 5.4 | Aug 5 | Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement Affected: 1.0.0 through 1.10.3 |
| CVE-2026-102590 New | 5.0 | Oct 29 | Langflow OSS is affected by multiple vulnerabilities Affected: 1.0.0 through 1.12.3 |
| CVE-2026-79723 | 5.0 | Sep 10 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches Affected: 1.0.0 through 1.11.5 |
| CVE-2026-104308 New | 4.3 | Oct 29 | Langflow OSS is affected by multiple vulnerabilities Affected: 1.0.0 through 1.12.3 |
| CVE-2026-104310 New | 4.3 | Oct 29 | Langflow OSS is affected by multiple vulnerabilities Affected: 1.0.0 through 1.12.3 |
| CVE-2026-104315 New | 4.3 | Oct 29 | Langflow OSS is affected by multiple vulnerabilities Affected: 1.0.0 through 1.12.3 |
| CVE-2026-93679 | 4.3 | Oct 7 | Langflow OSS is affected by multiple vulnerabilities Affected: 1.0.0 through 1.12.2 |
| CVE-2026-18545 | 4.3 | Aug 28 | Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities Affected: 1.0.0 through 1.11.1 |
| CVE-2026-12763 | 4.2 | Sep 14 | Langflow is vulnerable to authentication bypass and insufficient session expiration Affected: 1.0.0 through 1.11.5 |
| CVE-2026-104312 New | 3.5 | Oct 29 | Langflow OSS is affected by multiple vulnerabilities Affected: 1.0.0 through 1.12.3 |