jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-104334 via lfx (>=1.10.0, <=1.12.0.dev10)

lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-104335 via lfx (>=1.10.0, <=1.12.0.dev10)

lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-base (>=0.10.0rc0, <=0.10.0) potentially affected by unknown CVE via lfx (1.10.0)

lfx PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - jf-langflow =1.10.0, =0.10.0rc0, =0.10.0 Source cves: unknown CVE Source advisory: GHSA-J8F7-X8JM-WMM4...

dzbanek-langflow-base (>=0.6.0, <=0.6.1) potentially affected by unknown CVE via lfx (0.1.13)

lfx PYPI version 0.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - dzbanek-langflow-base =0.6.0, =0.6.1 Source cves: unknown CVE Source advisory: OSV:GHSA-J8F7-X8JM-WMM4...

langflow-base (>=0.7.0, <=0.7.2), langflow-nightly (1.8.0.dev24) potentially affected by unknown CVE via lfx (0.2.1)

lfx PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - langflow-base =0.7.0, =0.7.2 - langflow-nightly 1.8.0.dev24 Source cves: unknown CVE Source advisory: OSV:GHSA-J8F7-X8JM-WMM4...

langflow-base (0.7.3) potentially affected by unknown CVE via lfx (0.2.2)

lfx PYPI version 0.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - langflow-base 0.7.3 Source cves: unknown CVE Source advisory: OSV:GHSA-J8F7-X8JM-WMM4...

langflow-base (>=0.8.0rc0, <=0.8.4) potentially affected by unknown CVE via lfx (0.3.4)

lfx PYPI version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - langflow-base =0.8.0rc0, =0.8.4 Source cves: unknown CVE Source advisory: OSV:GHSA-J8F7-X8JM-WMM4...

langflow-base (>=0.9.0, <=0.9.6) potentially affected by unknown CVE via lfx (0.4.6)

lfx PYPI version 0.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - langflow-base =0.9.0, =0.9.6 Source cves: unknown CVE Source advisory: OSV:GHSA-J8F7-X8JM-WMM4...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-base (>=0.10.0rc0, <=0.10.0) potentially affected by unknown CVE via lfx (1.10.0)

lfx PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - jf-langflow =1.10.0, =0.10.0rc0, =0.10.0 Source cves: unknown CVE Source advisory: OSV:GHSA-J8F7-X8JM-WMM4...

Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

Summary: A critical Authenticated Remote Code Execution RCE vulnerability exists in the validatecode function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec function. While it attempts to restrict execution to function definitions, i...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), jf-langflow (>=1.10.0, <=1.10.0.post7) +2 more potentially affected by CVE-2026-105697 via lfx (>=0.1.13, <=1.10.0)

lfx PYPI version =0.1.13, =0.6.0, =1.10.0, =0.7.0, =0.10.0 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-105697 Source advisory: MEND:CVE-2026-105697...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-base (>=0.10.0rc0, <=0.10.0) potentially affected by CVE-2026-51886 via lfx (1.10.0)

lfx PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - jf-langflow =1.10.0, =0.10.0rc0, =0.10.0 Source cves: CVE-2026-51886 Source advisory: MEND:CVE-2026-51886...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), jf-langflow (>=1.10.0, <=1.10.0.post7) +22 more potentially affected by CVE-2026-101861 via lfx (>=0.1.13, <=1.12.0.dev10)

lfx PYPI version =0.1.13, =0.6.0, =1.10.0, =1.8.0rc0, =0.7.0, =1.12.0.dev10 - langflow-nightly 1.8.0.dev24 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 -...

langflow-base (>=0.10.1rc0, <=1.11.0.dev50) potentially affected by CVE-2026-12766 via lfx (>=1.10.3, <=1.11.0.dev50)

lfx PYPI version =1.10.3, =0.10.1rc0, =1.11.0.dev50 Source cves: CVE-2026-12766 Source advisory: MEND:CVE-2026-12766...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), jf-langflow (>=1.10.0, <=1.10.0.post7) +22 more potentially affected by CVE-2026-78571 via lfx (>=0.1.13, <=1.12.0.dev10)

lfx PYPI version =0.1.13, =0.6.0, =1.10.0, =1.8.0rc0, =0.7.0, =1.12.0.dev10 - langflow-nightly 1.8.0.dev24 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 -...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-base (>=0.10.0rc0, <=1.11.0.dev50) potentially affected by CVE-2026-78575 via lfx (>=1.10.0, <=1.11.0.dev50)

lfx PYPI version =1.10.0, =1.10.0, =0.10.0rc0, =1.11.0.dev50 Source cves: CVE-2026-78575 Source advisory: MEND:CVE-2026-78575...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-base (>=0.10.0rc0, <=1.11.0.dev50) potentially affected by CVE-2026-79724 via lfx (>=1.10.0, <=1.11.0.dev50)

lfx PYPI version =1.10.0, =1.10.0, =0.10.0rc0, =1.11.0.dev50 Source cves: CVE-2026-79724 Source advisory: MEND:CVE-2026-79724...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), jf-langflow (>=1.10.0, <=1.10.0.post7) +2 more potentially affected by CVE-2026-79725 via lfx (>=0.1.13, <=1.11.0.dev50)

lfx PYPI version =0.1.13, =0.6.0, =1.10.0, =0.7.0, =1.11.0.dev50 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-79725 Source advisory: MEND:CVE-2026-79725...

langflow-base (>=1.12.0.dev0, <=1.12.0.dev10) potentially affected by CVE-2026-79742 via lfx (>=1.12.0.dev0, <=1.12.0.dev10)

lfx PYPI version =1.12.0.dev0, =1.12.0.dev0, =1.12.0.dev10 Source cves: CVE-2026-79742 Source advisory: MEND:CVE-2026-79742...

langflow-base (>=0.10.1rc0, <=1.11.0.dev50) potentially affected by CVE-2026-79742 via lfx (>=1.10.3, <=1.11.0.dev50)

lfx PYPI version =1.10.3, =0.10.1rc0, =1.11.0.dev50 Source cves: CVE-2026-79742 Source advisory: MEND:CVE-2026-79742...