Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.

▾ Hadallangflow · langflowEPSS 100%via NVD

Tagged “osv”

Data exposure via ZeroMQ on multi-node vLLM deployment

Go Snowflake Driver has race condition when checking access to Easy Logging configuration file

AWorld OS Command Injection vulnerability

markdownify allows large headline prefixes such as <h9999999>, which causes memory consumption

CNCF K3s Kubernetes kubelet configuration exposes credentials

Mattermost Playbooks fails to validate the uniqueness and quantity of task actions

Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type

h11 accepts some malformed Chunked-Encoding bodies

`hugepage_rs::dealloc` may allow invalid memory deallocation from safe code

`FormatContext` stream accessors can cause undefined behavior from safe code

CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0

LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py

GoBGP panics due to a zero value for softwareVersionLen

In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters

Traefik affected by Go oauth2/jws Improper Validation of Syntactic Correctness of Input vulnerability

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

Crawl4AI SSRF vulnerability

Rasa Pro Missing Authentication For Voice Connector APIs

Mattermost vulnerable to Observable Timing Discrepancy

PyTorch Improper Resource Shutdown or Release vulnerability

Whoogle allows attackers to execute arbitrary code via supplying a crafted search query

mholt/archiver Vulnerable to Path Traversal via Crafted ZIP File

Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm

Mattermost Fails to Restrict Certain Operations on System Admins

TigerVNC accessible via the network and not just via a UNIX socket as intended

CVE-2025-1386- Query smuggling in ch-go library

Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

xgrammar Vulnerable to Denial of Service (DoS) by abusing unbounded cache in memory

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint