2197 matches found
EUVD-2026-71598
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process...
CVE-2026-19298 Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpoint
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process...
CVE-2026-19298 Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpoint
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process...
CVE-2026-19301 Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery...
EUVD-2026-71597
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery...
CVE-2026-19301
IBM Langflow OSS versions 1.0.0 through 1.11.2 are affected by Server-Side Request Forgery (SSRF) due to missing or bypassable URL validation across multiple components. Specifically, the LMStudio and embeddings components pass a user-controlled base_url directly to httpx.AsyncClient without invo...
CVE-2026-19301 Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery...
CVE-2026-19303 Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory...
CVE-2026-19303
IBM Langflow OSS versions 1.0.0 through 1.11.2 are affected by a path traversal vulnerability (CWE-22) in file-processing components. When deployed with S3 storage mode , the file component path resolution skips the local-access confinement check, and the default-enabled delete-after-processing f...
CVE-2026-19303 Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory...
EUVD-2026-71596
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory...
CVE-2026-19300
IBM Langflow OSS versions 1.0.0 through 1.11.2 are affected by an information disclosure vulnerability in the unauthenticated public flow endpoint. The endpoint uses a heuristic denylist to scrub stored secrets from node templates, but omits fields such as Authentication, X-Session-Id, App-Key, a...
CVE-2026-19300 Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields...
EUVD-2026-71271
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields...
CVE-2026-19300 Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields...
CVE-2026-19299
IBM Langflow OSS versions 1.0.0 through 1.11.2 is affected by an authenticated path traversal vulnerability (CWE-22) in the ChatInput , bundle FileInput , and GitExtractor components. The root cause is that these components resolve file paths without invoking the LANGFLOW_RESTRICT_LOCAL_FILE_ACCE...
EUVD-2026-71270
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal...
CVE-2026-19299 Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal...
CVE-2026-19302 Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links...