Browse CVEs

HIGH 8.8 CVE-2026-5027EPSS 31% The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arb… Langflow Mitigation only Fix from $1,9502026-03-27 MEDIUM 6.5 CVE-2026-5025 The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only… Langflow Mitigation only Fix from $1,6002026-03-27 MEDIUM 5.4 CVE-2026-5026 The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves SVG files with the 'image/svg+xml' content type without sanitizing their content. S… Langflow Mitigation only Fix from $1,6002026-03-27 MEDIUM 5.3 CVE-2026-5022 The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated u… Langflow Mitigation only Fix from $1,6002026-03-27 HIGH 7.5 CVE-2026-0772 Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… Langflow Mitigation only Fix from $1,9502026-01-23 HIGH 7.1 CVE-2026-0771 Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… Langflow Mitigation only Fix from $1,9502026-01-23 CRITICAL 9.8 CVE-2026-0768 Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… Langflow Mitigation only Fix from $2,3002026-01-23 CRITICAL 9.8 CVE-2026-0769EPSS 34% Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… Langflow Mitigation only Fix from $2,3002026-01-23 CRITICAL 9.8 CVE-2024-42835 langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component. Langflow No fix yet Fix from $2,3002024-10-31