Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 6 total.
Insecure file path handling in IBM Langflow OSS (CVE-2026-13445)
CVE-2026-13445 affects IBM Langflow OSS and allows an authenticated attacker to exploit the SaveToFile component to read and modify other users' uploaded files by specifying absolute paths to victim storage locations....
Fixed in 1.10.2
OS command injection in IBM Langflow OSS Python Interpreter (CVE-2026-14499)
CVE-2026-14499 affects IBM Langflow OSS, where improper validation of user-supplied input in the Python Interpreter component allows an authenticated user to execute arbitrary OS commands with elevated privileges on t...
Fixed in 1.10.2
Path traversal in the API Request component of IBM Langflow OSS (CVE-2026-7667)
CVE-2026-7667 is a path traversal vulnerability in the API Request component of IBM Langflow OSS affecting the Content-Disposition header processing logic. An authenticated attacker can create a malicious flow pointin...
Fixed in 1.10.1
Path traversal in Langflow OSS File component tar extraction (CVE-2026-7872)
A path traversal vulnerability in the Langflow OSS File component's tar archive extraction functionality allows an authenticated attacker to upload a specially crafted tar archive containing symbolic links to read arb...
Fixed in 1.10.1
Remote code execution in IBM Langflow OSS (CVE-2026-7755)
CVE-2026-7755 is a remote code execution vulnerability in IBM Langflow OSS affecting the MCP server configuration file handling. The file upload endpoint accepted MCP configuration files without invoking the MCPServer...
Fixed in 1.10.1
Code injection in Langflow OSS API Graph Execution Engine (CVE-2026-8056)
CVE-2026-8056 is a code injection vulnerability in the parameter filtering mechanism of Langflow OSS's API Graph Execution Engine, specifically within the `apply_tweaks()` function. Authenticated attackers can craft A...
Fixed in 1.10.1