Langflow Oss
Approved changes feed: RSS · Atom
cpe:2.3:a:ibm:langflow_oss:1.10.1:*:*:*:*:*:*:*
part: a version: 1.10.1 update: *
| Vendor | Ibm (177c0602-9232-5933-8f2f-9d22f079d22d) |
|---|---|
| Product | Langflow Oss (76f13290-9e1a-5502-bd5b-80373b8c1904) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14499 |
vulnerable | 2026-07-29 00:26:17.071586 |
Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
HIGH (8.8)
IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component.
Published: 2026-07-17T19:57:05.308Z
Updated: 2026-07-23T03:56:12.051Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13448 |
vulnerable | 2026-07-29 00:23:33.049590 |
Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
HIGH (8.1)
IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow_id}/flow ). The vulnerability stems from an incomplete denylist in the validate_public_flow_no_code_execution() function that fails to block several code-execution agent components including OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent.
Published: 2026-07-17T20:03:30.430Z
Updated: 2026-07-23T03:56:13.520Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13446 |
vulnerable | 2026-07-29 00:23:33.048910 |
Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
CRITICAL (9.8)
IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
Published: 2026-07-17T20:43:49.355Z
Updated: 2026-07-23T03:56:14.257Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13445 |
vulnerable | 2026-07-29 00:23:33.048186 |
Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
HIGH (8.1)
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths pointing to victim storage locations. In append mode, the attacker's workflow reads victim file contents, appends attacker-controlled data, and uploads a copy containing victim data to the attacker's namespace (confidentiality breach). In overwrite mode, the attacker can replace victim file contents with arbitrary data (integrity breach). This breaks the storage ownership boundary between users.
Published: 2026-07-17T20:44:38.924Z
Updated: 2026-07-23T03:56:14.982Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.