CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Langflow /api/v1/responses IDOR Vulnerability Leading to Unauthorized Flow Execution (CVE-2026-55255)
[Affected Scope] Langflow versions prior to 1.9.1
[Impact] An authenticated attacker can execute arbitrary AI workflows belonging to other users by exploiting an IDOR vulnerability, potentially exposing sensitive data.
[Mitigation] Immediately upgrade Langflow to version 1.9.1 or higher, and restrict network access until patched.
Langflow CORS Misconfiguration and Token Hijacking leading to Remote Code Execution (CVE-2025-34291)
[Affected Scope] Langflow versions up to and including 1.6.9
[Impact] Attackers can hijack victim sessions to take over accounts and execute arbitrary code via built-in code execution features, leading to full system compromise
[Mitigation] Upgrade Langflow to the latest patched version, restrict CORS configurations, and update refresh token cookie attributes to Lax/Strict
Ray AI Compute Engine DNS Rebinding Remote Code Execution Vulnerability (CVE-2025-62593)
[Affected Scope] Developers running Ray AI compute engine versions prior to 2.52.0 in local or development environments
[Impact] Remote Code Execution (RCE) on the developer's machine via DNS rebinding and browser-based request forgery when visiting malicious websites or viewing malvertisements
[Mitigation] Immediately upgrade the Ray package to version 2.52.0 or higher