Skip to content
Threat Feed
Subscribe

Vendor

Langflow

10 briefs RSS
high advisory

Multiple Vulnerabilities in Langflow

Langflow contains multiple vulnerabilities that enable remote attackers to achieve remote code execution with administrative privileges and bypass existing security controls.

Langflow vulnerability rce
2t
high advisory

Security Bypass Vulnerability in LiteLLM

A vulnerability in LiteLLM, tracked as CVE-2024-4786, allows remote authenticated attackers to circumvent established security controls.

LiteLLM +7
3t 1c updated
high advisory

Multiple Vulnerabilities in Langflow OSS

Langflow OSS contains multiple security flaws that could allow unauthenticated attackers to bypass security controls, exfiltrate sensitive data, and perform unauthorized data manipulation.

Langflow OSS
1t
critical threat

DD-WRT Stack-Based Buffer Overflow Vulnerability (CVE-2021-27137)

CVE-2021-27137 is a stack-based buffer overflow vulnerability in DD-WRT's UPnP component that allows an unauthenticated attacker to trigger remote code execution on affected router devices.

exploited DD-WRT +2 vulnerability-exploitation firmware router rce buffer-overflow
1t 4c
critical threat

CVE-2026-63030: Critical Remote Code Execution Vulnerability in WordPress Core

CVE-2026-63030 is a critical unauthenticated remote code execution vulnerability affecting WordPress Core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, allowing an unauthenticated attacker to execute arbitrary code via the WordPress REST API batch endpoint, potentially leading to complete website compromise.

exploited PoC WordPress Core 6.9.0 +51 wordpress rce web-vulnerability cve
2t 15c 8i updated
high threat

Agentic AI Used to Conduct Ransomware Attack via Langflow

Threat actor JadePuffer exploited CVE-2025-3248 in Langflow instances, leveraging agentic LLM capabilities for advanced reconnaissance, lateral movement, and ultimately encrypting data on production servers with ransomware.

exploited Langflow +1 JadePuffer ransomware ai agentic-ai vulnerability-exploitation data-encryption lateral-movement persistence
2r 10t 2c
critical advisory

Langflow 1.3.0 Remote Code Execution Vulnerability

Langflow 1.3.0 contains a remote code execution vulnerability (CVE-2026-0770) due to untrusted input in the exec_globals parameter at the validate endpoint, allowing remote attackers to execute arbitrary code as root without authentication, as demonstrated by a public exploit.

langflow 1.3.0 +3 remote-code-execution webapps langflow
1r 1t 5i updated
critical threat

Citrix NetScaler ADC and Gateway CVE-2026-3055 Exploitation

Threat actors are actively exploiting CVE-2026-3055, a critical memory overread vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances configured as a SAML identity provider (IDP), to extract sensitive information, including authenticated administrative session IDs, potentially leading to full system takeover.

PoC Langflow +4 citrix netscaler cve-2026-3055 memory-overread information-disclosure
2r 3t 5c 1i updated
critical threat

Critical RCE Vulnerability in Langflow AI Pipelines (CVE-2026-33017)

A critical remote code execution vulnerability, CVE-2026-33017, exists in Langflow AI pipelines prior to version 1.9.0 that allows an unauthenticated remote attacker to execute code with full server process privileges, impacting availability, integrity, and confidentiality.

Siyuan +6 langflow rce cve-2026-33017 ai-pipeline
2r 2t 1i updated
medium advisory

Langflow Unauthenticated Image Retrieval Vulnerability (CVE-2026-33484)

Langflow versions 1.0.0 through 1.8.1 are vulnerable to an unauthenticated image retrieval vulnerability (CVE-2026-33484) that allows attackers to download any user's uploaded images without credentials in multi-tenant deployments by accessing the `/api/v1/files/images/{flow_id}/{file_name}` endpoint.

Langflow unauthenticated-access image-retrieval vulnerability
2r 1t