Skip to content
Threat Feed
Subscribe

Product

Langflow

8 briefs RSS
critical threat

DD-WRT Stack-Based Buffer Overflow Vulnerability (CVE-2021-27137)

CVE-2021-27137 is a stack-based buffer overflow vulnerability in DD-WRT's UPnP component that allows an unauthenticated attacker to trigger remote code execution on affected router devices.

exploited DD-WRT +2 vulnerability-exploitation firmware router rce buffer-overflow
1t 4c
critical threat

CVE-2026-63030: Critical Remote Code Execution Vulnerability in WordPress Core

CVE-2026-63030 is a critical unauthenticated remote code execution vulnerability affecting WordPress Core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, allowing an unauthenticated attacker to execute arbitrary code via the WordPress REST API batch endpoint, potentially leading to complete website compromise.

exploited PoC WordPress Core 6.9.0 +51 wordpress rce web-vulnerability cve
2t 15c 8i updated
critical advisory

IBM Langflow OSS Unauthenticated Remote Code Execution via Chained API Endpoints (CVE-2026-9198)

Unauthenticated attackers can achieve Remote Code Execution (RCE) on default IBM Langflow OSS deployments, versions 1.0.0 through 1.10.0, by chaining access to the `/api/v1/auto_login` endpoint, which mints SUPERUSER tokens, with the `/api/v1/validate/code` endpoint, which executes user-supplied code via `exec()`.

PoC Langflow OSS +3 remote-code-execution api-exploitation unauthenticated-access code-injection web-vulnerability ai-llm
1r 3t 3c 2i updated
high threat

Agentic AI Used to Conduct Ransomware Attack via Langflow

Threat actor JadePuffer exploited CVE-2025-3248 in Langflow instances, leveraging agentic LLM capabilities for advanced reconnaissance, lateral movement, and ultimately encrypting data on production servers with ransomware.

exploited Langflow +1 JadePuffer ransomware ai agentic-ai vulnerability-exploitation data-encryption lateral-movement persistence
2r 10t 2c
high advisory

Langflow Multiple Vulnerabilities Allow Remote Code Execution and Denial of Service

Multiple vulnerabilities in Langflow allow a remote, anonymous attacker to execute arbitrary code or cause a denial of service.

Langflow vulnerability rce dos
2r 2t
medium advisory

Langflow Vulnerability Allows Denial of Service

An authenticated remote attacker can exploit a vulnerability in Langflow to perform a denial-of-service attack, impacting system availability.

Langflow denial-of-service web-application
1r 1t
critical advisory

Langflow Multiple Vulnerabilities Allow Code Execution

An authenticated remote attacker can exploit multiple unspecified vulnerabilities in Langflow to achieve arbitrary code execution.

Langflow code-execution web-application
2r 1t
medium advisory

Langflow Unauthenticated Image Retrieval Vulnerability (CVE-2026-33484)

Langflow versions 1.0.0 through 1.8.1 are vulnerable to an unauthenticated image retrieval vulnerability (CVE-2026-33484) that allows attackers to download any user's uploaded images without credentials in multi-tenant deployments by accessing the `/api/v1/files/images/{flow_id}/{file_name}` endpoint.

Langflow unauthenticated-access image-retrieval vulnerability
2r 1t