Open Source Langflow <1.12.3

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

3critical14high7medium0low

updated 2026-10-27

vulnerabilities (25)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-93674US	critical9.8	15.3% (97th)	Exploit	no fix	2026-10-07	—
CVE-2026-104335US	high8.8	0.87% (59th)	Exploit	no fix	2026-10-07	—
CVE-2026-97655US	high8.8	0.78% (56th)	—	no fix	2026-10-07	—
CVE-2026-97676US	high8.8	0.73% (54th)	—	no fix	2026-10-07	—
CVE-2026-104334US	critical9.8	0.71% (53rd)	—	no fix	2026-10-07	—
CVE-2026-88962US	high8.8	0.68% (52nd)	—	no fix	2026-10-07	—
CVE-2026-97679US	high8.8	0.66% (51st)	—	no fix	2026-10-07	—
CVE-2026-93675US	critical9.8	0.63% (50th)	—	no fix	2026-10-07	—
CVE-2026-97673US	high8.8	0.61% (49th)	—	no fix	2026-10-07	—
CVE-2026-97678US	high8.8	0.57% (47th)	—	no fix	2026-10-07	—
CVE-2026-97671US	medium6.5	0.50% (43rd)	—	no fix	2026-10-07	—
CVE-2026-103360US	medium6.5	0.49% (42nd)	—	no fix	2026-10-07	—
CVE-2026-93448US	medium6.5	0.46% (39th)	—	no fix	2026-10-07	—
CVE-2026-93445US	high8.8	0.44% (38th)	—	no fix	2026-10-07	—
CVE-2026-93449US	high8.8	0.41% (35th)	—	no fix	2026-10-07	—
CVE-2026-93443US	high8.8	0.40% (34th)	—	no fix	2026-10-07	—
CVE-2026-93677US	medium6.5	0.32% (25th)	—	no fix	2026-10-07	—
CVE-2026-93679US	medium4.3	0.31% (24th)	—	no fix	2026-10-07	—
CVE-2026-97674US	high8.1	0.31% (23rd)	—	no fix	2026-10-07	—
CVE-2026-93447US	high7.5	0.29% (21st)	—	no fix	2026-10-07	—
CVE-2026-101331US	medium6.5	0.29% (21st)	—	no fix	2026-10-07	—
CVE-2026-97680US	high8.3	0.27% (18th)	—	no fix	2026-10-07	—
CVE-2026-101329US	medium6.5	0.26% (18th)	—	no fix	2026-10-07	—
CVE-2026-93678US	high7.6	0.25% (17th)	—	no fix	2026-10-07	—
CVE-2026-97677US	—	—	—	no fix	—	—

The flaw types (CWEs) most of these CVEs share.

CWE-94Improper Control of Generation of Code ('Code Injection')10 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3 CVEs
CWE-284Improper Access Control3 CVEs
CWE-693Protection Mechanism Failure2 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs
CWE-400Uncontrolled Resource Consumption1 CVEs
CWE-440Expected Behavior Violation1 CVEs
CWE-502Deserialization of Untrusted Data1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.