L
Vendor security profile2 actively exploited CVEs
langflow-ai
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs9
Critical3
CISA KEV2
Public exploit6
Patch rate%33
Avg. CVSS7.2
12-month vulnerability rate
0
0
0
0
0
0
1
1
0
0
1
5
CVE KEV
CVE severity distribution
9toplam CVE
Critical3 (33%)
High3 (33%)
Medium2 (22%)
Low1 (11%)
Patch and exploitation view
%33
Verified patch
%22
CISA KEV
%67
Public exploit
3Patch available
0Partial
0Workaround
0Vendor: no patch
6Unknown
Latest vulnerabilities
7.1
CVE-2026-105741
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
L
Patch status unknownEPSS %0
9.9
CVE-2026-105740
Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server
L
Patch status unknownEPSS %1
7.1
CVE-2026-105699
Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
L
Patch status unknownEPSS %0
5.4
CVE-2026-105698
Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
L
Patch status unknownEPSS %0
9.9
CVE-2026-105697
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
L
Patch status unknownEPSS %0
2.1
CVE-2026-101861
Langflow Code Execution via eval() in Component Input Schema
L
Patch verifiedEPSS %0
8.4
CVE-2026-55255 Actively exploited
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
L
Patch verifiedEPSS %1
5.3
CVE-2026-7700
langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injection
L
Patch status unknownEPSS %0
9.8
CVE-2025-3248 Actively exploited
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
L
Patch verifiedEPSS %100