Search for packages
| purl | pkg:pypi/langflow-base@0.0.60 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-4gv9-mp8m-592r
Aliases: CVE-2025-57760 |
Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE) This vulnerability was discovered by researchers at **Check Point**. We … |
Vulnerable |
|
GHSA-8c4j-f57c-35cf
Aliases: CVE-2026-34046 |
Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check ## Vulnerability ### IDOR in `GET/PATCH/DELETE … |
Vulnerable |
|
GHSA-c5cp-vx83-jhqx
Aliases: CVE-2026-21445 |
Langflow Missing Authentication on Critical API Endpoints ### Summary Multiple critical API endpoints in Langflow are missing authentication controls, allowing … |
Vulnerable |
|
PYSEC-2026-380
Aliases: CVE-2025-3248 GHSA-rvqx-wpfh-mfx7 PYSEC-2025-36 |
Langflow Unauth RCE Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and … |
Vulnerable |
|
PYSEC-2026-2570
Aliases: CVE-2026-34046 GHSA-8c4j-f57c-35cf PYSEC-2026-2567 |
Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check ## Vulnerability ### IDOR in `GET/PATCH/DELETE … |
Vulnerable |
|
PYSEC-2026-2571
Aliases: CVE-2026-21445 GHSA-c5cp-vx83-jhqx PYSEC-2026-1524 |
Langflow Missing Authentication on Critical API Endpoints ### Summary Multiple critical API endpoints in Langflow are missing authentication controls, allowing … |
Vulnerable |
|
PYSEC-2026-1526
Aliases: CVE-2025-57760 GHSA-4gv9-mp8m-592r PYSEC-2025-243 |
Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE) This vulnerability was discovered by researchers at **Check Point**. We … |
Vulnerable |
|
PYSEC-2026-2572
Aliases: CVE-2026-6596 GHSA-vvfc-fp59-m92g |
Langflow: DoS Through Lack of File Size Restriction via Deprecated Unauthenticated File Upload API A security flaw has been discovered … |
Vulnerable |
|
GHSA-j8f7-x8jm-wmm4
|
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, … |
Not vulnerable |
|
PYSEC-2026-4238
Aliases: CVE-2026-105698 GHSA-gh98-4phw-6fmw PYSEC-2026-4234 |
Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints ### Summary Before **Langflow 1.10.1**, two deprecated but … |
Vulnerable |