IBM Langflow OSS

Name: IBM Langflow OSS
Brand: IBM

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

8critical20high2medium0low

updated 2026-10-27

vulnerabilities (79)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-9198US	—OT critical	28.7% (98th)	KEV	no fix	2026-07-17	2 versions
CVE-2026-10134US	—	2.32% (83rd)	Exploit	no fix	2026-06-30	≤ 1.0.0 ≤1.9.3
CVE-2026-7873US	—	1.55% (75th)	Exploit	no fix	2026-06-30	≤ 1.0.0 ≤1.10.0
CVE-2026-12940US	—	0.94% (61st)	Exploit	no fix	2026-07-30	≤ 1.0.0 ≤1.10.1
CVE-2026-17633US	high8.8	0.68% (52nd)	Exploit	no fix	2026-08-05	≤ 1.0.0 ≤1.10.3
CVE-2026-9103US	—OT elevated	3.21% (88th)	—	no fix	2026-07-17	2 versions
CVE-2026-8476US	—	0.97% (62nd)	—	no fix	2026-07-17	2 versions
CVE-2026-17632US	—	0.88% (59th)	—	no fix	2026-08-05	≤ 1.0.0 ≤1.10.3
CVE-2026-8481US	—	0.88% (59th)	—	no fix	2026-07-17	2 versions
CVE-2026-81204US	critical9.8	0.86% (58th)	—	no fix	2026-09-10	≤ vers:unknown/*
CVE-2026-9135US	—	0.84% (58th)	—	no fix	2026-07-17	2 versions
CVE-2026-10561US	—	0.82% (57th)	—	no fix	2026-06-22	≤ 1.0.0 ≤1.9.3
CVE-2026-81940US	high8.8	0.81% (57th)	—	no fix	2026-09-10	≤ vers:unknown/*
CVE-2026-79742US	high8.8	0.81% (57th)	—	no fix	2026-09-10	≤ vers:unknown/*
CVE-2026-78571US	high8.8	0.81% (57th)	—	no fix	2026-09-10	≤ vers:unknown/*
CVE-2026-17625US	high8.8	0.80% (56th)	—	no fix	2026-08-05	≤ 1.0.0 ≤1.10.3
CVE-2026-78575US	high8.8	0.79% (56th)	—	no fix	2026-09-10	≤ vers:unknown/*
CVE-2026-17623US	—	0.79% (56th)	—	no fix	2026-08-05	≤ 1.0.0 ≤1.10.3
CVE-2026-7524US	—	0.79% (56th)	—	no fix	2026-05-27	≤ 1.0.0 ≤1.9.1
CVE-2026-17630US	high8.8	0.76% (55th)	—	no fix	2026-08-05	≤ 1.0.0 ≤1.10.3
CVE-2026-7755US	—	0.75% (55th)	—	no fix	2026-07-17	2 versions
CVE-2026-8505US	—OT elevated	0.72% (54th)	—	no fix	2026-07-17	2 versions
CVE-2026-7871US	—	0.69% (53rd)	—	no fix	2026-06-30	≤ 1.0.0 ≤1.10.0
CVE-2026-76059US	high8.8	0.68% (52nd)	—	no fix	2026-09-10	≤ vers:unknown/*
CVE-2026-17624US	high8.8	0.68% (52nd)	—	no fix	2026-08-05	≤ 1.0.0 ≤1.10.3
CVE-2026-79724US	critical9.8	0.67% (52nd)	—	no fix	2026-09-10	≤ vers:unknown/*
CVE-2026-13448US	critical9.8	0.67% (52nd)	—	no fix	2026-07-17	≤ 1.0.0 ≤1.10.1
CVE-2026-14499US	—	0.66% (52nd)	—	no fix	2026-07-17	2 versions
CVE-2026-78569US	high8.8	0.65% (51st)	—	no fix	2026-09-10	≤ vers:unknown/*
CVE-2026-8182US	—	0.65% (51st)	—	no fix	2026-08-05	≤ 1.0.0 ≤1.10.3
CVE-2026-7803US	—	0.64% (51st)	—	no fix	2026-06-30	≤ 1.0.0 ≤1.10.0
CVE-2026-8478US	—	0.63% (50th)	—	no fix	2026-08-05	≤ 1.0.0 ≤1.10.3
CVE-2026-12946US	—	0.63% (50th)	—	no fix	2026-07-30	≤ 1.0.0 ≤1.10.0
CVE-2026-81941US	high8.8	0.63% (50th)	—	no fix	2026-09-10	≤ vers:unknown/*
CVE-2026-7872US	high8.1	0.62% (50th)	—	no fix	2026-07-17	2 versions
CVE-2026-12942US	high7.5	0.62% (50th)	—	no fix	2026-07-30	≤ 1.0.0 ≤1.10.1
CVE-2026-85025US	critical9.8OT elevated	0.61% (49th)	—	no fix	2026-09-10	≤ vers:unknown/*
CVE-2026-19297US	—	0.61% (49th)	—	no fix	2026-08-13	≤ 1.0.0 ≤1.9.6
CVE-2026-8635US	—	0.59% (48th)	—	no fix	2026-07-17	2 versions
CVE-2026-8183US	high7.7	0.56% (46th)	—	no fix	2026-08-05	≤ 1.0.0 ≤1.10.3
CVE-2026-8859US	—	0.56% (46th)	—	no fix	2026-07-17	2 versions
CVE-2026-7667US	—	0.56% (46th)	—	no fix	2026-07-17	2 versions
CVE-2026-81211US	high8.8OT elevated	0.56% (46th)	—	no fix	2026-09-10	≤ vers:unknown/*
CVE-2026-10700US	—	0.54% (45th)	—	no fix	2026-07-30	≤ 1.0.0 ≤1.8.4
CVE-2026-13435US	—	0.53% (45th)	—	no fix	2026-07-30	≤ 1.0.0 ≤1.10.1
CVE-2026-8056US	—	0.53% (45th)	—	no fix	2026-07-17	2 versions
CVE-2026-9196US	high8.8	0.53% (44th)	—	no fix	2026-08-05	≤ 1.0.0 ≤1.10.3
CVE-2026-7663US	critical9.8OT elevated	0.52% (44th)	—	no fix	2026-06-30	≤ 1.0.0 ≤1.9.6
CVE-2026-7658US	—	0.51% (43rd)	—	no fix	2026-08-05	≤ 1.0.0 ≤1.10.3
CVE-2026-9202US	—OT elevated	0.50% (43rd)	—	no fix	2026-07-17	2 versions

showing 50 of 79

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-94Improper Control of Generation of Code ('Code Injection')20 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')9 CVEs
CWE-639Authorization Bypass Through User-Controlled Key7 CVEs
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')7 CVEs
CWE-918Server-Side Request Forgery (SSRF)6 CVEs
CWE-306Missing Authentication for Critical Function4 CVEs
CWE-184Incomplete List of Disallowed Inputs2 CVEs
CWE-20Improper Input Validation2 CVEs

sources (2)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)68 CVEs
NLNCSC-NL (CSAF)26 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan