Medium
CVE-2026-48520
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 43
Reset filters
High
CVE-2026-33760
Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints
Critical
CVE-2026-55447
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
Critical
CVE-2026-42048
Langflow Knowledge Bases API is Vulnerable to Path Traversal
Critical
CVE-2026-33873
Langflow has Authenticated Code Execution in Agentic Assistant Validation
High
CVE-2026-34046
Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check
High
CVE-2026-33497
langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading
High
CVE-2026-33484
langflow has Unauthenticated IDOR on Image Downloads
Critical
CVE-2026-33309
Langflow has an Arbitrary File Write (RCE) via v2 API
High
CVE-2026-33053
Langflow is Missing Ownership Verification in API Key Deletion (IDOR)
Critical
Exploited in attacks
CVE-2026-33017
Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint
Critical
CVE-2026-27966
Langflow has Remote Code Execution in CSV Agent
High
CVE-2026-21445
Langflow Missing Authentication on Critical API Endpoints
High
CVE-2025-68478
External Control of File Name or Path in Langflow
High
Exploited in attacks
CVE-2025-34291
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with all
High
CVE-2025-57760
Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)
Critical
Exploited in attacks
CVE-2025-3248
Langflow Unauth RCE
Critical
CVE-2024-42835
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Critical
CVE-2024-37014
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.