Langflow Desktop
Approved changes feed: RSS · Atom
cpe:2.3:a:ibm:langflow_desktop:1.6.0:*:*:*:*:*:*:*
part: a version: 1.6.0 update: *
| Vendor | Ibm (177c0602-9232-5933-8f2f-9d22f079d22d) |
|---|---|
| Product | Langflow Desktop (398d1ed3-3604-5cc6-b05f-cf394dfdc0ca) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-3357 |
vulnerable | 2026-06-08 08:01:18.511608 |
IBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle file
HIGH (8.8)
IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component.
Published: 2026-04-08T00:19:11.414Z
Updated: 2026-04-08T15:41:55.112Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3346 |
vulnerable | 2026-06-08 08:01:18.494574 |
Stored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRaw
MEDIUM (6.4)
IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Published: 2026-04-30T21:06:10.276Z
Updated: 2026-05-01T16:38:14.702Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.