CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,498 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,498
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product langflow:langflow. Show all products

171 CVEs, showing 151 to 171PreviousPage 4 of 4
CVESeverityTitlePublished
CVE-2026-5027High 8.8The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path trav…Mar 27, 2026
CVE-2026-5026Medium 5.4The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves SVG files with the 'image/svg+xml' content type without sanitizing their content.Mar 27, 2026
CVE-2026-5025Medium 6.5The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer.Mar 27, 2026
CVE-2026-5022Medium 5.3The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to download images belonging to any flow by kn…Mar 27, 2026
CVE-2026-33497High 7.5Langflow is a tool for building and deploying AI-powered agents and workflows.Mar 24, 2026
CVE-2026-33484High 7.5Langflow is a tool for building and deploying AI-powered agents and workflows.Mar 24, 2026
CVE-2026-33475Critical 9.1Langflow is a tool for building and deploying AI-powered agents and workflows.Mar 24, 2026
CVE-2026-33309Critical 9.9Langflow is a tool for building and deploying AI-powered agents and workflows.Mar 24, 2026
CVE-2026-33053High 8.8Langflow is a tool for building and deploying AI-powered agents and workflows.Mar 20, 2026
CVE-2026-33017
Known exploited
Critical 9.3Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
Assigned by GitHub_M
Mar 20, 2026
CVE-2026-27966Critical 9.8Langflow is a tool for building and deploying AI-powered agents and workflows.Feb 26, 2026
CVE-2026-0772High 7.5Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability.Jan 23, 2026
CVE-2026-0771High 7.1Langflow PythonFunction Code Injection Remote Code Execution Vulnerability.Jan 23, 2026
CVE-2026-0769Critical 9.8Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability.Jan 23, 2026
CVE-2026-0768Critical 9.8Langflow code Code Injection Remote Code Execution Vulnerability.Jan 23, 2026
CVE-2026-0770
Known exploited
Critical 9.8Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
Assigned by zdi
Jan 23, 2026
CVE-2026-21445Critical 9.1Langflow is a tool for building and deploying AI-powered agents and workflows.Jan 2, 2026
CVE-2025-68478High 7.1Langflow is a tool for building and deploying AI-powered agents and workflows.Dec 19, 2025
CVE-2025-68477Medium 6.5Langflow is a tool for building and deploying AI-powered agents and workflows.Dec 19, 2025
CVE-2025-34291
Known exploited
Critical 9.4Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
Assigned by VulnCheck
Dec 5, 2025
CVE-2025-3248
Known exploited
Critical 9.8Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
Assigned by VulnCheck
Apr 7, 2025
PreviousPage 4 of 4

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.