Search for packages
| purl | pkg:pypi/langflow-base@0.7.0 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-4xn4-uppj-hqcp
Aliases: CVE-2026-6596 GHSA-vvfc-fp59-m92g |
Langflow: DoS Through Lack of File Size Restriction via Deprecated Unauthenticated File Upload API A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function create_upload_file of the file src/backend/base/Langflow/api/v1/endpoints.py of the component API Endpoint. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. |
Affected by 0 other vulnerabilities. |
|
VCID-qwtw-q92t-quhz
Aliases: CVE-2026-21445 GHSA-c5cp-vx83-jhqx |
Langflow Missing Authentication on Critical API Endpoints Multiple critical API endpoints in Langflow are missing authentication controls, allowing any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-06T08:14:10.809209+00:00 | GitLab Importer | Affected by | VCID-4xn4-uppj-hqcp | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/langflow-base/CVE-2026-6596.yml | 38.6.0 |
| 2026-06-06T06:34:28.004001+00:00 | GitLab Importer | Affected by | VCID-qwtw-q92t-quhz | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/langflow-base/CVE-2026-21445.yml | 38.6.0 |