Langflow

Threat actors are actively exploiting an unauthenticated remote code execution vulnerability, identified as CVE-2026-0768, within the open-source Langflow framework. This exploit allows malicious actors to gain unauthorized access and steal sensitive information, including credentials, tokens, and API keys.

Threat actors are actively exploiting two critical vulnerabilities affecting Langflow and Ruby on Rails, according to new findings from VulnCheck. These vulnerabilities are being leveraged for credential probing and command-and-control (C2) activities, indicating a significant security risk for users…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive mandating federal agencies to address critical vulnerabilities within three days. These vulnerabilities are present in IBM Langflow, N-central, and Apache Tomcat, and CISA has confirmed they are actively…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) officially added three critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on August 5, 2026, based on confirmed evidence of their active exploitation in real-world cyberattacks.

The Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent directive on Tuesday, mandating U.S. federal agencies to prioritize patching a critical remote code execution (RCE) vulnerability within the Langflow visual framework.

Researchers at Sysdig have identified a new ransomware strain, dubbed ENCFORGE, that specifically targets files critical to artificial intelligence infrastructure. This ransomware, written in Go, is designed to encrypt essential AI components such as model weights, vector indexes, and training…

A Go-based botnet identified as NadMesh began actively targeting exposed AI services in early July. The botnet's operator claims to have collected 3,811 unique AWS keys through its operations. NadMesh utilizes a Shodan harvester to continuously identify vulnerable AI platforms…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a directive on Monday, mandating that all federal agencies prioritize patching a critical authentication bypass vulnerability within the Langflow visual framework.

A new ransomware campaign named JadePuffer has been orchestrated entirely by an artificial intelligence, representing the first known instance of a large language model (LLM) autonomously conducting a cyberattack. Cloud security firm Sysdig detailed JadePuffer's capabilities in a recent report…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog on Tuesday, citing evidence of active exploitation. These vulnerabilities are now subject to mandatory patching for federal agencies.

Security firm Sysdig's Threat Research Team has identified what it believes to be the first ransomware attack fully executed by an artificial intelligence agent. This AI operator, dubbed JADEPUFFER, reportedly utilized a large language model to manage the entire attack…

Threat actors are actively exploiting a critical vulnerability in Langflow, a popular open-source framework for building and deploying large language model (LLM) applications, to deploy Monero cryptocurrency miners. The attacks leverage CVE-2026-33017, an unauthenticated remote code execution (RCE) flaw…

An unpatched security vulnerability, identified as CVE-2026-5027, within the open-source AI application development platform Langflow is actively being exploited. VulnCheck reported on March 18, 2026, that this critical flaw, with a CVSS score of 8.8, enables path traversal, allowing attackers…