Langflow — known exploited vulnerabilities

The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for Langflow with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.

5 KEV entries

1 ransomware-linked

1 product

avg CVSS 9.3

last added 2026-07-21

Key findings

CISA's Known Exploited Vulnerabilities catalog lists 5 Langflow vulnerabilities confirmed as exploited in the wild across 1 product; 1 of them (20%) is flagged as used in known ransomware campaigns. All entries affect a single product: Langflow. CISA added 4 entries in 2026 so far, compared with 1 in 2025. Across the 5 entries with an NVD CVSS score (100% of the total), the average score is 9.3; 3 entries are rated critical by NVD. The most recent addition is CVE-2026-0770 (Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability), added on 2026-07-21.

Affected products

Product	Entries	Share
Langflow	5	100%

Entries added per year

By date added to the KEV catalog

Exploited Langflow vulnerabilities (5)

Newest first. CVSS scores from NVD where available.

CVE	Product	Vulnerability	Date added	Ransomware	CVSS
CVE-2026-0770	Langflow	Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability	2026-07-21	—	CRITICAL9.8
CVE-2026-55255	Langflow	Langflow Authorization Bypass Through User-Controlled Key Vulnerability	2026-07-07	—	HIGH8.4
CVE-2025-34291	Langflow	Langflow Origin Validation Error Vulnerability	2026-05-21	—	HIGH8.8
CVE-2026-33017	Langflow	Langflow Code Injection Vulnerability	2026-03-25	—	CRITICAL9.8
CVE-2025-3248	Langflow	Langflow Missing Authentication Vulnerability	2025-05-05	Known	CRITICAL9.8

Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.