langflow has 94 CVEs on record between 2024 and 2026. Disclosure cadence is accelerating: 65 in the last 90 days against 13 in the 90 before. The busiest recent month was September 2026 with 35. The median CVSS is 8.4 (high), with 18 rated critical. 4% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 98 days (4 cases). The dominant weakness classes are CWE-94 (21) and CWE-22 (14).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 4% vs 1% corpus
- Median CVSS
- 8.4
- Publish → KEV
- 98 d median(4)
- Last 90 days
- 65 prev 13
Worst active — by depth score
CVE-2025-3248Critical· 9.8Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint100CVE-2025-34291High· 8.8Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution92CVE-2026-0770HighLangflow affected by Remote Code Execution via validate_code() exec()79CVE-2026-27966Critical· 9.8Langflow has Remote Code Execution in CSV Agent73CVE-2026-55255High· 8.4Langflow is a tool for building and deploying AI-powered agents and workflows71
langflow vulnerabilities
CVEs affecting langflow, newest first. Open any entry for full detail, references, and exploit status.
94 CVEsRSS
CVE-2025-57760High· 8.8Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)
Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)
CVE-2025-3248Critical· 9.8CISA KEVPoCLangflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
CVE-2024-48061Critical· 9.8PoCLangflow vulnerable to remote code execution
Langflow vulnerable to remote code execution
CVE-2024-9277Low· 3.5Inefficient Regular Expression Complexity in langflow
Inefficient Regular Expression Complexity in langflow