EUVD-2026-91119

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

EUVD-2026-91120

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...

CVE-2026-51888

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

CVE-2026-51886

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...

CVE-2026-51886

The langflow-ai langflow application (up to version v1.9.3 ) is vulnerable to a Code Injection vulnerability in the validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 function within src/backend/base/langflow/api/v1/validate.py:13. A public-facing route accepts raw Python source...

CVE-2026-51888

The langflow-ai langflow software (up to version 1.8.4 ) is vulnerable to an absolute path traversal vulnerability within the knowledge_bases-create_knowledge_base-a-live-http-post-to-create_knowledge_base component, specifically located at src/backend/base/langflow/api/v1/knowledge_bases.py:51. ...

CVE-2025-40978

Stored Cross-Site Scripting XSS vulnerability in WorkDo's eCommerceGo SaaS, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request to ‘/ticket/x/conversion’, using the ‘replydescription’ parameter...