Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- HighLangflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource HandlersEPSS 0.2%Oct 7, 2026
- Critical9.8IBM Langflow Code Injection VulnerabilityKEVEPSS 28.7%Jul 17, 2026
- High8.4Langflow Authorization Bypass Through User-Controlled Key VulnerabilityKEVEPSS 0.9%Jun 23, 2026
- Critical9.6Langflow is a tool for building and deploying AI-powered agents and workflows.May 12, 2026
- Low2.1A weakness has been identified in langflow-ai langflow up to 1.10.2.May 3, 2026
- Low2.1A vulnerability was determined in langflow-ai langflow up to 1.8.4.May 3, 2026
- High8.8IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges of the process running Langflow.Apr 30, 2026
- High8.1IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flow_id to read transaction logs and vertex build data belonging to other users, and to delete pe…Apr 30, 2026
- Medium6.5IBM Langflow Desktop <=1.8.4 Langflow could allow a remote attacker to traverse directories on the system.Apr 30, 2026
- High7.5IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view other users' images due to an indirect object reference through a user-controlled key.Apr 30, 2026
- Medium6.5IBM Langflow Desktop 1.2.0 through 1.8.4 Langflow could allow an authenticated attacker to traverse directories on the system.Apr 30, 2026
- Medium6.4IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting.Apr 30, 2026
- Medium6.5IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vulnerable to server-side request forgery (SSRF).Apr 30, 2026
- Low2.0A flaw has been found in langflow-ai langflow up to 1.8.3.Apr 20, 2026
- Low2.1A vulnerability was detected in langflow-ai langflow up to 1.8.3.Apr 20, 2026
- Low2.1A security vulnerability has been detected in langflow-ai langflow up to 1.8.3.Apr 20, 2026
- Low2.0A weakness has been identified in langflow-ai langflow up to 1.8.3.Apr 20, 2026
- Medium5.5A security flaw has been discovered in langflow-ai langflow up to 1.1.0.Apr 20, 2026
- High8.8IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting whic…Apr 8, 2026
- High8.7Langflow is a tool for building and deploying AI-powered agents and workflows.Mar 27, 2026
- Critical9.3Langflow is a tool for building and deploying AI-powered agents and workflows.Mar 27, 2026
- High8.8The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations o…Mar 27, 2026
- High7.0The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves SVG files with the 'image/svg+xml' content type without sanitizing their content.Mar 27, 2026
- Medium6.5The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer.Mar 27, 2026
- Medium6.3The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to download im…Mar 27, 2026
35 records · page 1 of 2
PreviousNext