Vendor

Langflow

5 of 7 Langflow CVEs in Patchfirst (71%) are in of vulnerabilities exploited in the wild, 1 of them used by ransomware.

CVEs: 7
In CISA KEV: 571%
Known ransomware use: 1
Median days to KEV: 28; from publication
Latest KEV listing: 21 Jul 2026

Watch Langflow Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
Langflow In KEV: 5 CVEs: 7

Top ATT&CK techniques

What attackers do with Langflow CVEs

TechniqueCVEs
T1059Command and Scripting Interpreter CVEs: 4
T1190Exploit Public-Facing Application CVEs: 4
T1005Data from Local System CVEs: 1

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/langflow.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are Langflow CVEs linked to the technique. Each link’s provenance is on the CVE page.

Langflow CVEs

7 CVEs, by priority

CVE-2025-3248Langflow Missing Authentication Vulnerability
Langflow · LangflowKEVRansomwarePublic exploitCritical · 9.8T1059Command and Scripting Interpreter
>99.9%Top 0.01%
79.9priority
CVE-2026-0768Langflow code Code Injection Remote Code Execution Vulnerability
Langflow · LangflowPublic exploitCritical · 9.8
28.1%Top 1.9%
79.1priority
CVE-2025-34291Langflow Origin Validation Error Vulnerability
Langflow · LangflowKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
92.8%Top 0.17%
78.0priority
CVE-2026-33017Langflow Code Injection Vulnerability
Langflow · LangflowKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
96.2%Top 0.12%
74.8priority
CVE-2026-0770Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Langflow · LangflowKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
62.6%Top 0.81%
74.7priority
CVE-2026-0769Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability
Langflow · LangflowPublic exploitCritical · 9.8
41.2%Top 1.3%
73.2priority
CVE-2026-55255Langflow Authorization Bypass Through User-Controlled Key Vulnerability
Langflow · LangflowKEVPublic exploitHigh · 8.4T1190Exploit Public-Facing Application T1005Data from Local System
0.9%Top 41%
65.7priority