Critical
CVE-2026-105697
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 43
Reset filters
Medium
CVE-2026-105698
Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
High
CVE-2026-105699
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
High
CVE-2026-105741
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
Medium
ghsa-j8f7-x8jm-wmm4
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)
Critical
CVE-2026-10561
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
Critical
CVE-2026-9205
Langflow: Weak Fernet Key via random.seed()
Critical
CVE-2026-8505
Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass
High
CVE-2026-51886
Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
High
CVE-2026-7700
Langflow: Prompt injection in Langflow Smart Transform can lead to code execution
Medium
CVE-2026-42867
Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint
Low
CVE-2026-6599
Langflow vulnerable to injection
Low
CVE-2026-6598
Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint
Low
CVE-2026-6597
Langflow has an Information Leak through Incomplete API Key Redaction
Medium
CVE-2026-6596
Langflow: DoS Through Lack of File Size Restriction via Deprecated Unauthenticated File Upload API
High
Exploited in attacks
CVE-2026-0770
Langflow affected by Remote Code Execution via validate_code() exec()
High
CVE-2025-68477
Langflow vulnerable to Server-Side Request Forgery
Medium
CVE-2024-48061
Langflow vulnerable to remote code execution
Medium
CVE-2024-9277
Inefficient Regular Expression Complexity in langflow
Medium
CVE-2026-55423
Langflow: Logout button does not clear session
High
Exploited in attacks
CVE-2026-55255
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
Critical
CVE-2026-55450
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
High
CVE-2026-55446
Langflow: Unauthenticated DoS through multipart form boundary file upload
Critical
CVE-2026-48519
Langflow: Unauthenticated RCE in Shareable Playgrounds
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.