Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
IBM

IBM Langflow OSS vulnerabilities

176 published CVEs name IBM Langflow OSS among the affected products; CISA lists 1 of them as exploited in the wild.

All 176 in the listAtom feed of new CVEs
Published CVEs
176
Last 12 months
176
Critical
38
Known exploited
1

Critical 38High 89Medium 48Low 1Not scored 0

Known exploitedNewest addition to KEV first

  • CVE-2026-9198

    Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

    IBM · Langflow OSS

    ExploitedCritical9.8

Newest CVEs

  • CVE-2026-18894

    Langflow OSS is affected by multiple vulnerabilities

    IBM · Langflow OSS

    Medium6.5
  • CVE-2026-77817

    Langflow OSS is affected by multiple vulnerabilities

    IBM · Langflow OSS

    Medium6.5
  • CVE-2026-77819

    Langflow OSS is affected by multiple vulnerabilities

    IBM · Langflow OSS

    Medium6.5
  • CVE-2026-90991

    Langflow OSS is affected by multiple vulnerabilities

    IBM · Langflow OSS

    Medium6.5
  • CVE-2026-93680

    Langflow OSS is affected by multiple vulnerabilities

    IBM · Langflow OSS

    Critical9.8
  • CVE-2026-102590

    Langflow OSS is affected by multiple vulnerabilities

    IBM · Langflow OSS

    Medium5.0
  • CVE-2026-103092

    Langflow OSS is affected by multiple vulnerabilities

    IBM · Langflow OSS

    High8.5
  • CVE-2026-101288

    Langflow OSS is affected by multiple vulnerabilities

    IBM · Langflow OSS

    High8.8
  • CVE-2026-104308

    Langflow OSS is affected by multiple vulnerabilities

    IBM · Langflow OSS

    Medium4.3
  • CVE-2026-104309

    Langflow OSS is affected by multiple vulnerabilities

    IBM · Langflow OSS

    Medium6.5

Most common weaknesses

  1. CWE-94 Code injection42
  2. CWE-22 Path traversal27
  3. CWE-918 Server-side request forgery (SSRF)22
  4. CWE-639 Authorization bypass through a user-controlled key (IDOR)13
  5. CWE-78 OS command injection9
  6. CWE-284 Improper access control8
  7. CWE-287 Improper authentication6
  8. CWE-306 Missing authentication for a critical function6
  9. CWE-502 Deserialization of untrusted data5
  10. CWE-200 Exposure of sensitive information4