Vulnerabilidades en langflow-ai
42 resultadosCVE-2025-3248CRITICALLangflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/codeEPSS 100.0%KEVCVE-2026-33017CRITICALLangflow has Unauthenticated Remote Code Execution via Public Flow Build EndpointEPSS 96.4%KEVCVE-2026-5027HIGHLangflow - Path Traversal Arbitrary File Write via upload_user_fileEPSS 40.0%CVE-2026-27966CRITICALLangflow has Remote Code Execution in CSV AgentEPSS 35.2%CVE-2026-21445HIGHLangflow Missing Authentication on Critical API EndpointsEPSS 33.3%CVE-2026-33497HIGHLangflow: /profile_pictures/{folder_name}/{file_name} endpoint file readingEPSS 19.6%CVE-2026-33309CRITICALLangflow has an Arbitrary File Write (RCE) via v2 APIEPSS 13.5%CVE-2025-68477HIGHLangflow vulnerable to Server-Side Request ForgeryEPSS 6.3%CVE-2026-33484HIGHLangflow has Unauthenticated IDOR on Image DownloadsEPSS 5.9%CVE-2025-68478HIGHLangflow Vulnerable to External Control of File Name or PathEPSS 5.8%CVE-2026-42048CRITICALLangflow: Path Traversal in Langflow Knowledge Bases APIEPSS 4.2%CVE-2026-105740CRITICALLangflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the serverEPSS 3.9%CVE-2026-33475CRITICALLangflow GitHub Actions Shell InjectionEPSS 3.2%CVE-2026-7687MEDIUMlangflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injectionEPSS 3.0%CVE-2026-33873CRITICALLangflow has Authenticated Code Execution in Agentic Assistant ValidationEPSS 1.5%CVE-2026-55450CRITICALLangflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leakEPSS 1.2%CVE-2026-105697CRITICALLangflow: OS command injection (RCE) via arbitrary command in MCP stdio server configurationEPSS 0.9%CVE-2026-55255HIGHLangflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's FlowEPSS 0.9%KEVCVE-2026-48519CRITICALLangflow: Unauthenticated RCE in Shareable PlaygroundsEPSS 0.8%CVE-2026-55447CRITICALLangflow: BaseFileComponent-based nodes arbitrary file read with RCE exploitEPSS 0.7%