AdvisoriesToolsStatsChecklistSubmitGet the email
← All tools
LLM frameworks · Langflow

Langflow

Visual builder for AI agents and workflows, with MCP support.

1Advisories
1critical
0high
0medium
2026-10-05Latest
Timeline · advisories per quarter
12026 Q4
Named in sources

Reported for Langflow

01. criticalCode executionLangflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)Langflow launched whatever command a user put in an MCP stdio server config, through bash -c, with no allowlist. Any user who could add an MCP server or build a flow could run OS commands on the Langflow host, and with the default auto-login no account was needed. Langflow MCP SDKs & servers 2026-10-05
The weekly email

One email a week. Only what changed.

New advisories, CVEs and fixes for Lovable, Bolt, v0, Replit, Base44 and Cursor apps. No roundups of things you already read.

Free. The list is new, so the first issues go out once there are readers. Unsubscribe from any email in one click. We never sell or share addresses.