Skip to content
OpenAdvisories

Product · IBM

Langflow Desktop

8 known vulnerabilities.

Langflow Desktop at a glance

Last 12 months
8
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 7 vulnerabilities May 2026: 0 vulnerabilities June 2026: 1 vulnerability Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202610
May 202600
Apr 202670
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Latest advisories

  • Medium max 7.5
    WID-SEC-2026-2855 1 CVE rev. 2

    IBM Langflow Desktop: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen und Manipulation von Daten

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM Langflow Desktop ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Daten zu manipulieren.

    IBM Windows
    first Aug 16, 2026
  • High max 9.1
    WID-SEC-2026-2839 1 CVE

    IBM Langflow Desktop: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM Langflow Desktop ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

    IBM Windows
  • High max 8.8
    WID-SEC-2026-2619 7 CVEs rev. 2

    IBM Langflow Desktop: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in IBM Langflow Desktop ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, um Dateien zu Manipulieren, und um Sicherheitsvorkehrungen zu umgehen.

    IBM Windows
    first Aug 2, 2026
  • High max 8.8
    WID-SEC-2026-2675 17 CVEs

    IBM Langflow Desktop: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in IBM Langflow Desktop ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, um einen SQL-Inject…

    IBM Windows
  • Critical max 9.9
    WID-SEC-2026-2410 14 CVEs 1 exploited rev. 2

    IBM Langflow Desktop OSS: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in IBM Langflow Desktop OSS ausnutzen, um Administratorrechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder einen Denial-of-Service-Zustand zu v…

    IBM Windows
    first Jul 19, 2026
All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Medium 5.4
    CVE-2026-3341

    IBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal Services

    IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other…

    IBM Langflow Desktop
  • High 8.8
    CVE-2026-6543

    Authenticated Remote Code Execution Vulnerability in Langflow Code Validation Endpoint

    IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variables (API keys, DB credentials), modifying files, or launchi…

    IBM Langflow Desktop
  • Medium 6.5
    CVE-2026-3345

    Path Traversal and Arbitrary File Write Vulnerability in IBM Langflow Desktop API v2 File Upload Endpoint

    IBM Langflow Desktop <=1.8.4 Langflow could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

    IBM Langflow Desktop
  • Medium 6.4
    CVE-2026-3346

    Stored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRaw

    IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cre…

    IBM Langflow Desktop
  • Medium 6.5
    CVE-2026-3340

    Server-Side Request Forgery (SSRF) in Langflow URL Component

    IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other…

    IBM Langflow Desktop
  • Medium 6.5
    CVE-2026-4502

    Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API

    IBM Langflow Desktop 1.2.0 through 1.8.4 Langflow could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

    IBM Langflow Desktop
  • High 7.5
    CVE-2026-4503

    Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint

    IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view other users' images due to an indirect object reference through a user-controlled key.

    IBM Langflow Desktop
  • High 8.8
    CVE-2026-3357

    IBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle file

    IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component.

    IBM Langflow Desktop