🧰 Langflow

The items that name it 29

• In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit
  articleas classification.technologies2026-10-16
• P.K. Sharma (@_pksharma) on X
  threadas tools2026-10-15It is written here as Langflow (AI flow builder; affected product).

  AI flow builder; affected product

• AWS Security Agent (now part of AWS Continuum) exploited 33 of 37 new real-world CVEs
  articleas classification.technologies2026-10-15
• Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules
  writeupas affected products2026-10-09

  versions <= 1.7.3; unauthenticated RCE (CVE-2026-0770)

• tl;dr sec #349 - Vulns & Exploits in the AI Era, Package Manager Sandboxing, Testing AI Sandboxes
  articleas affected products2026-10-08It is written here as Langflow (unauthenticated RCE exploited in the wild).

  unauthenticated RCE exploited in the wild

• Top AI agent security resources — October 2026
  articleas affected products2026-10-04
• Vulnerability Discovery and Exploitation Trends in the AI Era (Google Cloud)
  articleas affected products2026-09-30

  Affected by CVE-2026-5027 (path traversal file write) and CVE-2025-3248 (unauthenticated Python code injection via exec()); agent orchestration framework with dynamic code execution nodes exploited via prompt injection or crafted workflow JSONs.

• Storm-3168: Agentic-driven cloud attacks using compromised service principals
  writeupas affected products2026-09-25

  Code validation endpoint (/api/v1/validate/code) probed as a web-shell-like path

• Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?
  articleas affected products2026-09-25
• AI Agent Hacking Writeups
  repoas affected products2026-09-17
• Metasploit Wrap Up: This One Goes to Sixteen!
  articleas affected products2026-09-11

  Versions 1.10.0 and below; authenticated RCE (CVE-2026-19295)

• [tl;dr sec] #345 - Bug Rumors → Exploits, Version Control DFIR, Agentic Worms
  articleas affected products2026-09-10
• Top Agentic AI security resources — September 2026
  articleas affected products2026-09-04

  AI infrastructure platform; broken authorization vulnerability, fixed in version 1.5.1 (CVE-2026-34046)

• Inside 90 days of attacks on AI infrastructure
  writeupas affected products2026-08-27

  AI framework honeypotted; attacker staged miner at /app/data/.claude/ renamed 'unicorn'; ships unauthenticated by default.

• [tl;dr sec] #343 - Hugging Face Technical Report, AWSHound, OWASP Agentic Skills Top 10
  articleas affected products2026-08-27It is written here as Langflow (169% growth in exposure, 18 CVEs including unauthenticated RCE).

  169% growth in exposure, 18 CVEs including unauthenticated RCE

• How AI orchestration platforms ship RCE by design | Ebook/Report | Endor Labs
  paperas affected products2026-08-26
• Rumour Is the Exploit — AI agents collapse time-to-exploit to near-zero
  articleas affected products2026-08-22It is written here as Langflow (CVE-2026-33017).

  CVE-2026-33017

• Hacking your life with AI can get you hacked | Blog | Endor Labs
  writeupas affected products2026-08-18

  Smart Transform node validator (startswith('lambda') and ':' in lambda_text) bypassed to reach eval(lambda_text), allowing RCE from a single chat message. Fixed in 1.10.3 or 1.11.0. LANGFLOW_SKIP_AUTH_AUTO_LOGIN flag is a dangerous default.

• Cloud Threat Highlights: H1 2026
  writeupas affected products2026-08-06

  AI tool with a critical unauthenticated vulnerability; an RCE in Langflow was exploited to install a cryptominer disguised as AI tooling.

• AI Security Briefing
  advisoryas affected products2026-07-18
• AI Security Briefing
  writeupas affected products2026-07-18

  Open-source tool for building AI apps and agent workflows; vulnerable to CVE-2025-3248 unauthenticated RCE; often exposed on the internet holding API keys and cloud credentials.

• GoogleCloudPlatform/k8s-aibom
  repoas affected products2026-07-18
• PolinRider Confirmed Footprint Grows 6.5x Since March
  writeupas affected products2026-07-15

  Named among targeted projects with 1 million+ combined GitHub stars

• Orca Security: Langflow RCE (CVE-2026-33017) Actively Exploited
  advisoryas affected products2026-07-02

  Open-source AI application builder with over 145,000 GitHub stars, widely deployed in AI/ML pipeline infrastructure; approximately 7,000 servers were found internet-accessible at time of discovery. Version 1.8.2 was widely reported as patched but remains vulnerable per JFrog Security Research.

• Orca: CVE-2026-5027 Langflow Path Traversal RCE
  advisoryas affected products2026-06-12
• Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours | Sysdig
  writeupas classification.technologies2026-04-09
• AI-Infra-Guard (A.I.G) — Tencent Zhuque Lab
  repoas affected products

  AI component with CVE rules added in vuln library expansion (v4.6.2)

• DVLAA
  repoas affected products

  AWDP01-10 映射的公开披露开源 AI 项目之一

• Tencent/AI-Infra-Guard
  repoas affected products

  AI component covered by expanded vuln library (v4.6.2, 155 new CVE rules across 40+ AI components)

In every workspace you can read 31