Known Vulnerabilities for products from Langflow
Listed below are 15 of the newest known vulnerabilities associated with the vendor "Langflow".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-42048 json | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path... | Not Provided | 2026-05-12 | 2026-05-14 |
| CVE-2026-34046 json | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helpe... | Not Provided | 2026-03-27 | 2026-05-11 |
| CVE-2026-33873 json | Not Provided | 2026-03-27 | 2026-04-02 | |
| CVE-2026-33017 json | Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/b... | Not Provided | 2026-03-20 | 2026-05-21 |
| CVE-2026-7700 json | Not Provided | 2026-05-03 | 2026-05-05 | |
| CVE-2026-7687 json | Not Provided | 2026-05-03 | 2026-05-05 | |
| CVE-2026-7528 json | Not Provided | 2026-05-27 | 2026-05-27 | |
| CVE-2026-7524 json | Not Provided | 2026-05-27 | 2026-05-27 | |
| CVE-2026-6600 json | Not Provided | 2026-04-20 | 2026-04-20 | |
| CVE-2026-6599 json | Not Provided | 2026-04-20 | 2026-04-20 | |
| CVE-2026-6543 json | IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges of the... | Not Provided | 2026-04-30 | 2026-05-11 |
| CVE-2026-5026 json | The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves SVG files with the 'image/svg+xml' content type without sani... | Not Provided | 2026-03-27 | 2026-04-20 |
| CVE-2026-5025 json | The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buff... | Not Provided | 2026-03-27 | 2026-04-20 |
| CVE-2026-5022 json | The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, allowi... | Not Provided | 2026-03-27 | 2026-04-20 |
| CVE-2026-4503 json | IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view other users' images due to an i... | Not Provided | 2026-04-30 | 2026-05-11 |
| CVE-2026-4502 json | IBM Langflow Desktop 1.2.0 through 1.8.4 Langflow could allow an authenticated attacker to traverse directories on the system... | Not Provided | 2026-04-30 | 2026-05-11 |
| CVE-2026-3357 json | IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, ... | Not Provided | 2026-04-08 | 2026-04-14 |
| CVE-2026-3346 json | IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting. This vulnerability allows an a... | Not Provided | 2026-04-30 | 2026-05-11 |
| CVE-2026-3345 json | IBM Langflow Desktop <=1.8.4 Langflow could allow a remote attacker to traverse directories on the system. An attacker could ... | Not Provided | 2026-04-30 | 2026-05-11 |
| CVE-2026-3340 json | IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an ... | Not Provided | 2026-04-30 | 2026-05-11 |