Advisories · Technology
IBM Langflow Desktop.
Every CVE that names IBM Langflow Desktop among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.4 Medium
IBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal Services
- IBM Langflow Desktop
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Authenticated Remote Code Execution Vulnerability in Langflow Code Validation Endpoint
- IBM Langflow Desktop
- Code injection
- CVSS 6.5 Medium
Path Traversal and Arbitrary File Write Vulnerability in IBM Langflow Desktop API v2 File Upload Endpoint
- IBM Langflow Desktop
- Path traversal
- CVSS 6.4 Medium
Stored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRaw
- IBM Langflow Desktop
- SQL injection
- CVSS 6.5 Medium
Server-Side Request Forgery (SSRF) in Langflow URL Component
- IBM Langflow Desktop
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API
- IBM Langflow Desktop
- Path traversal
- CVSS 7.5 High
Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint
- IBM Langflow Desktop
- Broken access control
- CVSS 8.8 High
IBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle file
- IBM Langflow Desktop
- Insecure deserialization