Recent Advisories

Severity ID Title Vendor Product Date Type
CRITICAL 9.3 CVE-2026-55450

Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak_CVE-2026-55450

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data ...

langflow-ai langflow < 1.9.1 CVE
CRITICAL 9.6 CVE-2026-55447

Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit_CVE-2026-55447

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RA...

langflow-ai langflow < 1.9.2 CVE
CRITICAL 9.9 CVE-2026-55255

Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User’s Flow_CVE-2026-55255

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, an Insecure Direct Object Reference (IDOR) vulnerabi...

langflow-ai langflow < 1.9.2 CVE
CRITICAL 9.6 CVE-2026-48519

Langflow: Unauthenticated RCE in Shareable Playgrounds_CVE-2026-48519

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the "Shareable Playground" (or "Public Flows" in cod...

langflow-ai langflow < 1.9.2 CVE
CRITICAL 9.4 CVE-2026-44791

n8n: XML Node Prototype Pollution Patch Bypass_CVE-2026-44791

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modif...

n8n-io n8n < 1.123.43 CVE
CRITICAL 9.4 CVE-2026-44790

n8n: Arbitrary File Read via Git Node_CVE-2026-44790

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modif...

n8n-io n8n < 1.123.43 CVE
CRITICAL 9.4 CVE-2026-44789

n8n: HTTP Request Node Pagination Prototype Pollution to RCE_CVE-2026-44789

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modif...

n8n-io n8n < 1.123.43 CVE
CRITICAL 9.3 CVE-2026-54257

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow_CVE-2026-54257

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.1 until 42.3.3, Buffer performs i...

electron electron >= 42.3.1, < 42.3.3 CVE
CRITICAL 9 CVE-2026-54157

LobeHub: Unauthenticated SSRF in `/webapi/proxy`_CVE-2026-54157

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy e...

lobehub lobehub < 2.1.57 CVE
CRITICAL 9.6 CVE-2026-53662

immich: One-click account takeover via XSS in login page continue redirect_CVE-2026-53662

immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting ...

immich-app immich >= main@4ffa26c9, < main@4eb1003 CVE