IBM Langflow Desktop

Name: IBM Langflow Desktop
Brand: IBM

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

3critical11high1medium0low

updated 2026-10-27

vulnerabilities (65)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-9198US	—OT critical	28.7% (98th)	KEV	no fix	2026-07-17	2 versions
CVE-2026-12940US	—	0.94% (61st)	Exploit	1.10.2	2026-07-30	< 1.10.2
CVE-2026-17633US	high8.8	0.68% (52nd)	Exploit	1.11.0	2026-08-05	< 1.11.0
CVE-2026-9103US	—OT elevated	3.21% (88th)	—	no fix	2026-07-17	2 versions
CVE-2026-8476US	—	0.97% (62nd)	—	no fix	2026-07-17	2 versions
CVE-2026-17632US	—	0.88% (59th)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-8481US	—	0.88% (59th)	—	no fix	2026-07-17	2 versions
CVE-2026-9135US	—	0.84% (58th)	—	no fix	2026-07-17	2 versions
CVE-2026-17625US	high8.8	0.80% (56th)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-17623US	—	0.79% (56th)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-17630US	high8.8	0.76% (55th)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-7755US	—	0.75% (55th)	—	no fix	2026-07-17	2 versions
CVE-2026-8505US	—OT elevated	0.72% (54th)	—	no fix	2026-07-17	2 versions
CVE-2026-17624US	high8.8	0.68% (52nd)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-13448US	critical9.8	0.67% (52nd)	—	1.10.2	2026-07-17	< 1.10.2
CVE-2026-14499US	—	0.66% (52nd)	—	1.10.2	2026-07-17	2 versions
CVE-2026-8182US	—	0.65% (51st)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-8478US	—	0.63% (50th)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-12946US	—	0.63% (50th)	—	1.10.1	2026-07-30	< 1.10.1
CVE-2026-7872US	high8.1	0.62% (50th)	—	no fix	2026-07-17	2 versions
CVE-2026-12942US	high7.5	0.62% (50th)	—	1.10.2	2026-07-30	< 1.10.2
CVE-2026-19297US	—	0.61% (49th)	—	1.10.0	2026-08-13	< 1.10.0
CVE-2026-8635US	—	0.59% (48th)	—	no fix	2026-07-17	2 versions
CVE-2026-8183US	high7.7	0.56% (46th)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-8859US	—	0.56% (46th)	—	no fix	2026-07-17	2 versions
CVE-2026-7667US	—	0.56% (46th)	—	no fix	2026-07-17	2 versions
CVE-2026-10700US	—	0.54% (45th)	—	no fix	2026-07-30	≤ OSS <1.9.0
CVE-2026-13435US	—	0.53% (45th)	—	1.10.2	2026-07-30	< 1.10.2
CVE-2026-8056US	—	0.53% (45th)	—	no fix	2026-07-17	2 versions
CVE-2026-9196US	high8.8	0.53% (44th)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-19875US	—OT elevated	0.52% (44th)	—	1.10.1	2026-08-19	< 1.10.1
CVE-2026-7658US	—	0.51% (43rd)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-9202US	—OT elevated	0.50% (43rd)	—	no fix	2026-07-17	2 versions
CVE-2026-7646US	—	0.50% (43rd)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-8446US	—OT elevated	0.49% (42nd)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-6543US	—	0.47% (40th)	—	1.9.0	2026-04-30	2 versions
CVE-2026-3357US	—	0.47% (40th)	—	no fix	2026-04-08	≤ 1.6.0 ≤1.8.2
CVE-2026-9077US	—	0.44% (38th)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-17626US	—	0.42% (36th)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-10547US	high8.1	0.40% (34th)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-13446US	—OT elevated	0.38% (32nd)	—	1.10.2	2026-07-17	< 1.10.2
CVE-2026-9201US	—	0.38% (31st)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-7657US	—	0.38% (31st)	—	1.11.0	2026-08-05	< 1.11.0
CVE-2026-3345US	—	0.37% (31st)	—	1.9.0	2026-04-30	2 versions
CVE-2026-12945US	—	0.36% (30th)	—	1.10.2	2026-07-30	< 1.10.2
CVE-2026-13444US	—	0.35% (28th)	—	1.10.2	2026-07-30	< 1.10.2
CVE-2026-13445US	—	0.35% (28th)	—	1.10.2	2026-07-17	< 1.10.2
CVE-2026-7754US	medium6.5	0.34% (27th)	—	no fix	2026-07-17	2 versions
CVE-2026-4503US	—	0.34% (27th)	—	1.9.0	2026-04-30	2 versions
CVE-2026-7869US	—	0.32% (25th)	—	1.11.0	2026-08-05	< 1.11.0

showing 50 of 65

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-94Improper Control of Generation of Code ('Code Injection')14 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')10 CVEs
CWE-639Authorization Bypass Through User-Controlled Key7 CVEs
CWE-306Missing Authentication for Critical Function5 CVEs
CWE-918Server-Side Request Forgery (SSRF)5 CVEs
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')4 CVEs
CWE-184Incomplete List of Disallowed Inputs2 CVEs
CWE-502Deserialization of Untrusted Data2 CVEs

sources (3)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)64 CVEs
NLNCSC-NL (CSAF)15 CVEs
EUEU Vulnerability Database (ENISA)8 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan