langflow vulnerabilities — 87 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →
Severity Vulnerability Package Ecosystem Disclosed Fixed version
7.1 high CVE-2026-105699: Langflow Authenticated Cross-Project File Disclosure Vulnerability langflow PyPI 15 Oct 2026 1.9.1
5.4 medium CVE-2026-105698: Langflow Cross-User Flow Access and Vertex Execution Vulnerability langflow PyPI 15 Oct 2026 1.10.1
9.9 critical CVE-2026-105697: Langflow OS Command Injection Vulnerability Leading to Remote Code Execution langflow PyPI 15 Oct 2026 1.10.3
7.1 high CVE-2026-105741: Langflow IP Spoofing Bypass Vulnerability Leading to Remote Configuration Write langflow PyPI 15 Oct 2026 1.10.3
9.9 critical CVE-2026-10561: Langflow PythonREPLComponent Unsandboxed Code Execution Vulnerability langflow PyPI 15 Oct 2026 1.10.1
9.1 critical CVE-2026-9205: Langflow Critical Vulnerability Due to Weak Fernet Key Generation langflow PyPI 15 Oct 2026 1.10.1
8.8 high CVE-2026-51886: Langflow Authenticated Remote Code Execution via Malicious Decorators langflow PyPI 15 Oct 2026 1.10.1
8.8 high CVE-2026-7700: Langflow Code Injection Vulnerability in Smart Transform Component langflow PyPI 15 Oct 2026 1.10.3
9.8 critical CVE-2026-8505: Langflow Unauthenticated Flow Execution via Webhook Authentication Bypass langflow PyPI 15 Oct 2026 1.9.1
9.9 critical CVE-2026-105697: Langflow OS Command Injection Vulnerability Leading to Remote Code Execution langflow PyPI 07 Oct 2026 1.10.3
5.4 medium CVE-2026-105698: Langflow Cross-User Flow Access and Vertex Execution Vulnerability langflow PyPI 07 Oct 2026 1.10.1
7.1 high CVE-2026-105699: Langflow Authenticated Cross-Project File Disclosure Vulnerability langflow PyPI 07 Oct 2026 1.9.1
7.1 high CVE-2026-105741: Langflow IP Spoofing Bypass Vulnerability Allowing Remote Configuration Write langflow PyPI 07 Oct 2026 1.10.3
6.3 medium SSRF Vulnerability in Langflow Package: Unrestricted URL Access langflow PyPI 06 Oct 2026 1.10.3
9.9 critical CVE-2026-10561: Langflow PythonREPLComponent Unsandboxed Code Execution Vulnerability langflow PyPI 06 Oct 2026 1.10.1
9.1 critical CVE-2026-9205: Langflow Critical Vulnerability Due to Weak Fernet Key Derivation langflow PyPI 05 Oct 2026 1.10.1
9.8 critical CVE-2026-8505: Langflow Unauthenticated Flow Execution via Webhook Authentication Bypass langflow PyPI 05 Oct 2026 1.9.1
8.8 high CVE-2026-51886: Langflow Authenticated Remote Code Execution via Malicious Decorators langflow PyPI 05 Oct 2026 1.10.1
8.8 high CVE-2026-7700: Langflow Code Injection Vulnerability in Smart Transform Component langflow PyPI 05 Oct 2026 1.10.3
High Authenticated Remote Code Execution Vulnerability in langflow Package langflow PyPI 02 Oct 2026 No fix published
Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.