{"kind": "product", "path": "vulns/pypi/langflow", "name": "langflow", "product": "langflow", "ecosystem": "PyPI", "items": [{"id": "GHSA-j8f7-x8jm-wmm4", "noindex": false, "published": "2026-10-06T13:39:57Z", "modified": "2026-10-06T13:45:06.468251407Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-j8f7-x8jm-wmm4", "title": "Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)", "description": "### Summary\n\nBefore **Langflow 1.10.3**, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses and cloud metadata endpoints (for example `http://169.254.169.254/latest/meta-data/`), and in many cases read the response back through the component output.\n\nTwo things combined to cause this:\n\n1. **Protection disabled / warn-only.** The SSRF guard (`lfx/utils/ssrf_protection.py`, added in 1.7.0 by #10544) shipped with `ssrf_protection_enabl", "references": ["https://github.com/langflow-ai/langflow/security/advisories/GHSA-j8f7-x8jm-wmm4", "https://github.com/langflow-ai/langflow/pull/13016", "https://github.com/langflow-ai/langflow/pull/13395"], "fixes": ["1.10.3"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-105741", "noindex": false, "published": "2026-10-05T20:56:00.060Z", "modified": "2026-10-06T16:43:02.046Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "severity": "high", "epss": 0.00244, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-105741", "title": "Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write", "description": "Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the \"local-only\" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1 header, an attacker could make the server treat the request as originating from localhost, letting them write/overwrite an MCP client configuration file on the server's filesystem. This vulnerability is fixed in 1.10.3.", "references": ["https://github.com/langflow-ai/langflow/security/advisories/GHSA-4f6c-2vvp-gw82", "https://github.com/langflow-ai/langflow/pull/13915", "https://github.com/langflow-ai/langflow/commit/1f39a4b9d62c9dfa1b21fa7f85e23a180c351b72"], "fixes": ["1.10.3"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-105699", "noindex": false, "published": "2026-10-05T20:37:59.630Z", "modified": "2026-10-08T02:26:48.618Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00313, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-105699", "title": "Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers", "description": "Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. read_resource forwarded the attacker-controlled URI to handle_read_resource, which parsed a flow_id and filename and called storage_service.get_file without verifying that the flow belonged to the authenticated user or current project. A user with access to any project-scoped MCP endpoint could therefore request another user's flow-backed file, while global handle_list_resources and han", "references": ["https://github.com/langflow-ai/langflow/security/advisories/GHSA-4hmc-cfm3-w43c", "https://github.com/langflow-ai/langflow/pull/12818", "https://github.com/langflow-ai/langflow/commit/b8fe970493fd5fb2e1fc71dfccc79f90b76058fa"], "fixes": ["1.9.1"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-105698", "noindex": false, "published": "2026-10-05T20:20:27.287Z", "modified": "2026-10-06T13:58:36.614Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00225, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-105698", "title": "Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints", "description": "Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} handlers. Through version 1.7.1, an unauthenticated caller who knew another user's flow UUID could reach these handlers; from version 1.7.2 through 1.10.0, callers had to authenticate but needed no elevated privileges. Such a caller could cause retrieve_vertices_order to load and cache the private graph, enumerate its vertex identifiers, and use build_vertex to execute selected vertices and rec", "references": ["https://github.com/langflow-ai/langflow/security/advisories/GHSA-gh98-4phw-6fmw", "https://github.com/langflow-ai/langflow/pull/13153", "https://github.com/langflow-ai/langflow/commit/fb3d6ec90b1e4d52eaa40915a64b1f86b6542f55"], "fixes": ["1.10.1"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-105697", "noindex": false, "published": "2026-10-05T20:16:58.291Z", "modified": "2026-10-09T19:55:07.117Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00787, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-105697", "title": "Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration", "description": "Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c \"exec {command} ...\". Any user able to reach the MCP server settings (\"Settings → MCP Servers → Add MCP Server\", POST/PATCH /api/v2/mcp/servers/{server_name}) or to build a flow with the MCP Tools component could add a \"server\" whose command is an arbitrary OS command (touch, rm -rf, a reverse shell, ...). The command runs on the Langflow host as the Langflow process user as soon as Lang", "references": ["https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45", "https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2", "https://github.com/langflow-ai/langflow/pull/12290"], "fixes": ["1.10.3"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-51886", "noindex": false, "published": "2026-10-01T00:00:00.000Z", "modified": "2026-10-05T23:56:49.602Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.00602, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-51886", "title": "CVE-2026-51886", "description": "langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-t", "references": ["https://github.com/langflow-ai/langflow/issues/13336", "https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a", "https://nvd.nist.gov/vuln/detail/CVE-2026-51886"], "fixes": ["1.10.1"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-9205", "noindex": false, "published": "2026-08-05T18:09:11.795Z", "modified": "2026-08-07T12:56:44.463Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00302, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-9205", "title": "Langflow is affected by weaknesses in secret handling and sensitive configuration access", "description": "IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.", "references": ["https://www.ibm.com/support/pages/node/7282648", "https://nvd.nist.gov/vuln/detail/CVE-2026-9205"], "fixes": ["1.10.1"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-8505", "noindex": false, "published": "2026-07-17T19:06:00.986Z", "modified": "2026-07-23T03:56:06.902Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.00719, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-8505", "title": "Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution", "description": "IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False (which is the default setting). This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner, potentially leading to Remote Code Execution (RCE).", "references": ["https://www.ibm.com/support/pages/node/7278921", "https://nvd.nist.gov/vuln/detail/CVE-2026-8505"], "fixes": ["1.9.1"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-7873", "noindex": false, "published": "2026-06-30T19:13:16.331Z", "modified": "2026-07-01T17:27:51.362Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.0155, "kev": false, "exploits": ["metasploit"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-7873", "title": "Code Injection Vulnerability in Code Validation Endpoint", "description": "IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.", "references": ["https://www.ibm.com/support/pages/node/7278441", "https://nvd.nist.gov/vuln/detail/CVE-2026-7873"], "fixes": ["1.10.1.rc0"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-48520", "noindex": false, "published": "2026-06-23T16:31:27.362Z", "modified": "2026-06-24T14:19:11.074Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.00437, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-48520", "title": "Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read", "description": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the \"Shareable Playground\" (or \"Public Flows\" in code) contains a potential arbitrary file-read vulnerability, depending on the exact flow configuration used. By making a flow public, public execution of the flow is allowed. The execution request can contain a list of files that gets read by Langflow and fed into the LLM. The files path can be any path supported by the storage - it can be either a local file or S3 path if supported by the local configuration This vulnerability is fixed in 1.10.0.", "references": ["https://github.com/langflow-ai/langflow/security/advisories/GHSA-rcjh-r59h-gq37", "https://nvd.nist.gov/vuln/detail/CVE-2026-48520"], "fixes": ["1.10.0"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-33760", "noindex": false, "published": "2026-06-23T16:30:16.819Z", "modified": "2026-06-24T15:47:28.163Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00495, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-33760", "title": "Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints", "description": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources — messages, sessions, build artifacts, and LLM transaction logs — without verifying that the authenticated requester owns the targeted resource. Any authenticated user can read, modify, rename, or permanently delete another user's data by supplying the target's resource ID or flow_id. This is a classic IDOR/BOLA vulnerability. Notably, the same source file (monitor.py) contains one correctly-implemented endpoint that uses an ", "references": ["https://github.com/langflow-ai/langflow/security/advisories/GHSA-9c59-2mvc-vfr8", "https://nvd.nist.gov/vuln/detail/CVE-2026-33760"], "fixes": ["1.9.0"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-42867", "noindex": false, "published": "2026-06-23T16:29:11.848Z", "modified": "2026-06-23T17:02:43.824Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "severity": "medium", "epss": 0.00466, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-42867", "title": "Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint", "description": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem. This vulnerability is fixed in 1.9.0.", "references": ["https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq", "https://github.com/langflow-ai/langflow/pull/12337", "https://nvd.nist.gov/vuln/detail/CVE-2026-42867"], "fixes": ["1.9.0"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-55255", "noindex": false, "published": "2026-06-23T16:28:20.985Z", "modified": "2026-10-07T18:13:46.054Z", "cvss": 8.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L", "severity": "high", "epss": 0.00887, "kev": true, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-55255", "title": "Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow", "description": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.", "references": ["https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2", "https://github.com/langflow-ai/langflow/pull/12832", "https://github.com/langflow-ai/langflow/commit/2c9f498d664a3c32698b57d7c5e752625291060e"], "fixes": ["1.9.1", "1.9.2"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}, {"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-55423", "noindex": false, "published": "2026-06-23T16:27:19.134Z", "modified": "2026-06-23T17:07:10.031Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00222, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-55423", "title": "Langflow: Logout button does not clear session", "description": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. This vulnerability is fixed in 1.7.0.", "references": ["https://github.com/langflow-ai/langflow/security/advisories/GHSA-7hw8-6q6r-4276", "https://github.com/langflow-ai/langflow/pull/10527", "https://github.com/langflow-ai/langflow/pull/10528"], "fixes": ["1.7.0"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-55446", "noindex": false, "published": "2026-06-23T16:26:17.990Z", "modified": "2026-06-23T17:56:37.766Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00581, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-55446", "title": "Langflow: Unauthenticated DoS through multipart form boundary file upload", "description": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an indefinite amount of time. This vulnerability is fixed in 1.0.19.", "references": ["https://github.com/langflow-ai/langflow/security/advisories/GHSA-qwqc-p3q8-wcg9", "https://github.com/langflow-ai/langflow/pull/3923", "https://nvd.nist.gov/vuln/detail/CVE-2026-55446"], "fixes": ["1.0.19"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-48519", "noindex": false, "published": "2026-06-23T16:25:09.927Z", "modified": "2026-06-24T03:56:21.994Z", "cvss": 9.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00783, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-48519", "title": "Langflow: Unauthenticated RCE in Shareable Playgrounds", "description": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the \"Shareable Playground\" (or \"Public Flows\" in code) contains a critical RCE vulnerability. Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link. Specifically, it enables the route /api/v1/build_public_tmp to execute any public flow, given a public flow ID. When the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload. The vulnerable field is data.nodes[X].data.node.template.code.value. This vulnerability is fixed ", "references": ["https://github.com/langflow-ai/langflow/security/advisories/GHSA-v5ff-9q35-q26f", "https://nvd.nist.gov/vuln/detail/CVE-2026-48519"], "fixes": ["1.9.2"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-55447", "noindex": false, "published": "2026-06-23T16:21:42.570Z", "modified": "2026-06-24T15:47:39.931Z", "cvss": 9.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00662, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-55447", "title": "Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit", "description": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attacker can direct the node to read any file on the file-system by absolute path. All components based on BaseFileComponent are vulnerable to the vulnerability. This includes Docling (DoclingInlineComponent), Docling Serve, DoclingRemoteComponent), Read File (FileComponent), NVIDIA Retriever Extraction (NvidiaIngestComponent), Video File (VideoFileComponent), and Unstructured API (UnstructuredComponent). This vulnerability is fixed in 1.9.2.", "references": ["https://github.com/langflow-ai/langflow/security/advisories/GHSA-ccv6-r384-xp75", "https://github.com/langflow-ai/langflow/pull/12945", "https://nvd.nist.gov/vuln/detail/CVE-2026-55447"], "fixes": ["1.9.2"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-55450", "noindex": false, "published": "2026-06-23T16:17:52.168Z", "modified": "2026-06-23T17:02:55.053Z", "cvss": 9.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H", "severity": "critical", "epss": 0.0119, "kev": false, "exploits": ["nuclei", "public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-55450", "title": "Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak", "description": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the server. In addition, in the response, the absolute path of the uploaded file is reported to the attacker, which is an information leak that can assist in chaining other primitives. This vulnerability is fixed in 1.9.1.", "references": ["https://github.com/langflow-ai/langflow/security/advisories/GHSA-x223-p2gf-v735", "https://github.com/langflow-ai/langflow/pull/12831", "https://nvd.nist.gov/vuln/detail/CVE-2026-55450"], "fixes": ["1.9.1"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-10561", "noindex": false, "published": "2026-06-22T13:22:07.628Z", "modified": "2026-06-23T18:48:33.682Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.0082, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-10561", "title": "Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection", "description": "IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in complete compromise", "references": ["https://www.ibm.com/support/pages/node/7277242", "https://nvd.nist.gov/vuln/detail/CVE-2026-10561"], "fixes": ["1.10.1"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-42048", "noindex": false, "published": "2026-05-12T17:35:27.688Z", "modified": "2026-05-13T14:14:16.193Z", "cvss": 9.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "severity": "critical", "epss": 0.04195, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-42048", "title": "Langflow: Path Traversal in Langflow Knowledge Bases API", "description": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (DELETE /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are concatenated directly into file paths without proper sanitization or boundary validation. An authenticated attacker can exploit this flaw to delete arbitrary directories anywhere on the server's filesystem, leading to data loss and potential service disruption. This vulnerability is fixed in 1.9.0.", "references": ["https://github.com/langflow-ai/langflow/security/advisories/GHSA-9whx-c884-c68q", "https://nvd.nist.gov/vuln/detail/CVE-2026-42048"], "fixes": ["1.9.0"], "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}]}], "total": 43, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "langflow", "path": "vulns/pypi/langflow", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["1.10.3rc0", "1.10.2rc4", "1.10.2", "1.10.1rc3", "1.10.1.rc0", "1.10.1rc0", "1.10.1", "1.10.0rc0", "1.10.0", "1.9.6rc0", "1.9.6", "1.9.5"], "stats": {"recent": 6, "kev": 0}, "lastmod": "2026-10-09T19:55:07.117Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}