Approved changes feed: RSS · Atom
cpe:2.3:a:langflow-ai:langflow:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Langflow Ai (4bb48994-2b7e-588e-9eae-088f7480d0d1) |
|---|---|
| Product | Langflow (598ecdbf-76ba-56f5-b28e-2072b1763cfd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-55450 |
vulnerable | 2026-07-29 01:00:28.477821 |
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
CRITICAL (9.3)
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the server. In addition, in the response, the absolute path of the uploaded file is reported to the attacker, which is an information leak that can assist in chaining other primitives. This vulnerability is fixed in 1.9.1.
Published: 2026-06-23T16:17:52.168Z
Updated: 2026-06-23T17:02:55.053Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-55447 |
vulnerable | 2026-07-29 01:00:28.477594 |
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
CRITICAL (9.6)
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attacker can direct the node to read any file on the file-system by absolute path. All components based on BaseFileComponent are vulnerable to the vulnerability. This includes Docling (DoclingInlineComponent), Docling Serve, DoclingRemoteComponent), Read File (FileComponent), NVIDIA Retriever Extraction (NvidiaIngestComponent), Video File (VideoFileComponent), and Unstructured API (UnstructuredComponent). This vulnerability is fixed in 1.9.2.
Published: 2026-06-23T16:21:42.570Z
Updated: 2026-06-24T15:47:39.931Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-55446 |
vulnerable | 2026-07-29 01:00:28.477469 |
Langflow: Unauthenticated DoS through multipart form boundary file upload
HIGH (7.5)
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an indefinite amount of time. This vulnerability is fixed in 1.0.19.
Published: 2026-06-23T16:26:17.990Z
Updated: 2026-06-23T17:56:37.766Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-55423 |
vulnerable | 2026-07-29 01:00:28.459373 |
Langflow: Logout button does not clear session
MEDIUM (6.1)
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. This vulnerability is fixed in 1.7.0.
Published: 2026-06-23T16:27:19.134Z
Updated: 2026-06-23T17:07:10.031Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-55255 |
vulnerable | 2026-07-29 01:00:28.420471 |
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
HIGH (8.4)
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.
Published: 2026-06-23T16:28:20.985Z
Updated: 2026-07-08T03:56:30.245Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48520 |
vulnerable | 2026-07-29 00:55:01.375778 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48519 |
vulnerable | 2026-07-29 00:55:01.375481 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42867 |
vulnerable | 2026-07-29 00:49:32.331313 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33760 |
vulnerable | 2026-07-29 00:43:22.649082 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5027 |
vulnerable | 2026-06-08 08:07:02.892728 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5026 |
vulnerable | 2026-06-08 08:07:02.892241 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5025 |
vulnerable | 2026-06-08 08:07:02.891828 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5022 |
vulnerable | 2026-06-08 08:07:02.884917 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42048 |
vulnerable | 2026-06-08 08:03:15.888339 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34046 |
vulnerable | 2026-06-08 07:59:11.705260 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33873 |
vulnerable | 2026-06-08 07:59:11.553747 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33497 |
vulnerable | 2026-06-08 07:59:10.194248 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33484 |
vulnerable | 2026-06-08 07:59:10.155494 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33475 |
vulnerable | 2026-06-08 07:59:10.147770 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33309 |
vulnerable | 2026-06-08 07:59:09.653791 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33053 |
vulnerable | 2026-06-08 07:57:18.516736 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33017 |
vulnerable | 2026-06-08 07:57:18.466937 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27966 |
vulnerable | 2026-06-08 07:55:14.733909 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-21445 |
vulnerable | 2026-06-08 07:49:16.395895 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68478 |
vulnerable | 2026-06-08 07:41:21.182830 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68477 |
vulnerable | 2026-06-08 07:41:21.181639 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-57760 |
vulnerable | 2026-06-08 07:33:16.080451 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3248 |
vulnerable | 2026-06-08 07:23:08.537649 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.