CVE-2026-33017

Overview

langflow-ai
langflow

20 Mar 2026

Published

26 Mar 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

5.65%

MITRE

KEV

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

Statistics

6 Posts
10 Interactions

Last activity: 2 hours ago

Fediverse

/G|T|R|O|N|I|X\ :python: :emacs: :nix: :linux: @gtronix

"CISA: New Langflow flaw actively exploited to hijack AI workflows"

"[...] The Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are actively exploiting a critical vulnerability identified as CVE-2026-33017, which affects the Langflow framework for building AI agents."

https://www.bleepingcomputer.com/news/security/cisa-new-langflow-flaw-actively-exploited-to-hijack-ai-workflows/

#Cybersecurity

0
0
0
22h ago

CyberNetsecIO @netsecio

📰 CISA KEV Alert: Actively Exploited Flaws in Langflow AI Framework and Trivy Scanner

📢 CISA KEV UPDATE: Two flaws now under active exploitation! A critical RCE in Langflow AI framework (CVE-2026-33017) and a supply-chain attack via Trivy scanner (CVE-2026-33634). Patch now! ⚠️ #KEV #CyberSecurity #RCE

🔗 https://cyber.netsecops.io/articles/cisa-adds-exploited-trivy-and-langflow-flaws-to-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=twitter_auto

0
0
0
2h ago

Bluesky

BleepingComputer @bleepingcomputer.com

The Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are actively exploiting a critical vulnerability identified as CVE-2026-33017, which affects the Langflow framework for building AI agents.

1
6
1
23h ago

Cybersecurity News Everyday @hendryadrian.bsky.social

CISA reports active exploitation of CVE-2026-33017, a critical code injection flaw in Langflow AI-agent framework enabling unauthenticated remote Python code execution. Upgrade to Langflow 1.9.0 recommended. #Langflow #CISA #USA

0
3
0
21h ago

Lorenzo Ordóñez @lordman1982.bsky.social

CVE-2026-33017: How attackers compromised Langflow AI pipelines in 20 hours | Sysdig www.sysdig.com/blog/cve-202...

0
0
0
10h ago

CVE-2026-33634

Overview

aquasecurity
setup-trivy

23 Mar 2026

Published

27 Mar 2026

Updated

CVSS v4.0

CRITICAL (9.4)

EPSS

26.61%

MITRE

KEV

Description

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 – 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.2.0 – 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one's environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one's organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using `aquasecurity/trivy-action` or `aquasecurity/setup-trivy`. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19–20, 2026 for signs of compromise. Look for repositories named `tpcp-docs` in one's GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don't use mutable version tags.

Statistics

4 Posts
2 Interactions

Last activity: 2 hours ago

Fediverse

TechNadu @technadu

CISA adds CVE-2026-33634 (Trivy) to KEV - active exploitation confirmed.

If it’s in KEV, it’s already a threat.

Source: https://www.cisa.gov/news-events/alerts/2026/03/26/cisa-adds-one-known-exploited-vulnerability-catalog

💬 Is KEV your top patch priority?
🔔 Follow TechNadu

#InfoSec #KEV #CyberSecurity

1
0
0
10h ago

CyberNetsecIO @netsecio

📰 CISA KEV Alert: Actively Exploited Flaws in Langflow AI Framework and Trivy Scanner

📢 CISA KEV UPDATE: Two flaws now under active exploitation! A critical RCE in Langflow AI framework (CVE-2026-33017) and a supply-chain attack via Trivy scanner (CVE-2026-33634). Patch now! ⚠️ #KEV #CyberSecurity #RCE

🔗 https://cyber.netsecops.io/articles/cisa-adds-exploited-trivy-and-langflow-flaws-to-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=twitter_auto

0
0
0
2h ago

Bluesky

TechNadu @technadu.com

New KEV alert ⚠️ CVE-2026-33634 (Trivy) now actively exploited. KEV = real-world risk, not theory. 💬 Patch priority? 🔔 Follow TechNadu #CyberSecurity #KEV #InfoSec

1
0
0
10h ago

piggo @pigondrugs.bsky.social

~Cisa~ CISA added CVE-2026-33634 (Aqua Security Trivy) to the KEV catalog due to active exploitation. - IOCs: CVE-2026-33634 - #CISA #CVE202633634 #threatintel

0
0
0
22h ago

CVE-2026-3055

Overview

NetScaler
ADC

23 Mar 2026

Published

24 Mar 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

0.02%

MITRE

KEV

Description

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

Statistics

5 Posts
1 Interaction

Last activity: 4 hours ago

Fediverse

HackerWorkspace @hackerworkspace

March 26 Advisory: Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability [CVE-2026-3055] - Censys

https://censys.com/advisory/cve-2026-3055/

Short summary: https://hackerworkspace.com/article/march-26-advisory-citrix-netscaler-adc-and-gateway-out-of-bounds-read-vulnerability-cve-2026-3055-censys

#cybersecurity #vulnerability #exploit

0
0
0
23h ago

Andi @Andi

Zwei kritische Schwachstellen beherrschen die Lage für deutsche Unternehmen.
Das BSI warnt vor einer aktiv ausgenutzten Lücke in Microsoft SharePoint. Die CISA hatte die Schwachstelle am 18. März in ihren Katalog ausgenutzter Sicherheitslücken aufgenommen. CERT-EU veröffentlichte am 25. März ein Advisory und verwies auf Maßnahmen aus der ToolShell-Angriffskampagne des Vorjahres. Der CVSS-Score liegt bei 9.8 von 10 und wurde hochgestuft, nachdem sich herausstellte, dass eine Ausnutzung auch ohne Authentifizierung möglich ist.
Parallel dazu hat CERT-Bund am 24. März Alarm wegen zweier Schwachstellen in Citrix NetScaler ADC und NetScaler Gateway geschlagen. CVE-2026-3055 ermöglicht es nicht authentifizierten Angreifern, aktive Session-Token aus dem Speicher betroffener Geräte auszulesen. CVE-2026-4368 kann durch eine Race Condition zur Übernahme fremder Benutzersitzungen führen. Besonders gefährdet sind Systeme, die als SAML Identity Provider konfiguriert sind, also eine in Unternehmensumgebungen weit verbreitete Konfiguration für Single Sign-On. Sicherheitsforscher bewerten eine baldige aktive Ausnutzung als sehr wahrscheinlich.
Sofortmaßnahmen: SharePoint patchen, NetScaler aktualisieren und aktiven Sessions beenden.

Cybersicherheitswarnung 2026-238220-1032 (25.03.2026) | CERT-Bund WID-SEC-2026-0836 (24.03.2026)
CVE-2026-20963 | CVE-2026-3055 | CVE-2026-4368
#Informationssicherheit #CISO #BSI #SharePoint #Citrix #NetScaler #Patchmanagement #NIS2 #CyberSecurity #ITSicherheit

0
0
0
4h ago

Bluesky

CyberVeille @cyberveille-ch.bsky.social

📢 Citrix corrige deux vulnérabilités critiques dans NetScaler ADC et NetScaler Gateway 📝 ## 🛡️ Contexte Publié le 26 mars 2026 par The Hacker New… https://cyberveille.ch/posts/2026-03-26-citrix-corrige-deux-vulnerabilites-critiques-dans-netscaler-adc-et-netscaler-gateway/ #CVE_2026_3055 #Cyberveille

0
0
0
19h ago

Eyal Estrin ☁️ @eyalestrin.bsky.social

Articles about Citrix NetScaler vulnerabilities CVE-2026-3055 and CVE-2026-4368 (26.3.2026) #patchmanagement

0
0
0
22h ago

OpsMatters @opsmatters.com

The latest update for #CyCognito includes "Citrix NetScaler ADC and Gateway Vulnerabilities (CVE-2026-3055 & CVE-2026-4368)" and "Emerging Threat: Ubiquiti UniFi Network Application Path Traversal (CVE-2026-22557)". #cybersecurity #AttackSurfaceManagement #EASM https://opsmtrs.com/44Srq0X

0
1
0
17h ago

CVE-2026-25075

Overview

strongSwan
strongSwan

23 Mar 2026

Published

25 Mar 2026

Updated

CVSS v4.0

HIGH (8.7)

EPSS

0.12%

MITRE

KEV

Description

strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allows unauthenticated remote attackers to cause a denial of service by sending crafted AVP data with invalid length fields during IKEv2 authentication. Attackers can exploit the failure to validate AVP length fields before subtraction to trigger excessive memory allocation or NULL pointer dereference, crashing the charon IKE daemon.

Statistics

4 Posts

Last activity: 7 hours ago

Fediverse

HackerWorkspace @hackerworkspace

strongSwan CVE-2026-25075: Integer Underflow in VPN Authentication

https://bishopfox.com/blog/strongswan-cve-2026-25075-integer-underflow-in-vpn-authentication

Short summary: https://hackerworkspace.com/article/strongswan-cve-2026-25075-integer-underflow-in-vpn-authentication

#cybersecurity #vulnerability #exploit

0
0
1
20h ago

Bluesky

Bishop Fox @bishopfox.bsky.social

🚨 New research from Bishop Fox: CVE-2026-25075 An integer underflow in strongSwan’s EAP-TTLS parser allows unauthenticated attackers to crash VPN services. The vulnerability affects versions going back over 15 years. Upgrade to 6.0.5 or disable EAP-TTLS.

0
0
0
22h ago

Jon Williams @br4inde4d.bsky.social

We successfully exploited CVE-2026-25075, a denial of service affecting strongSwan VPN servers! Be sure to patch ASAP and check out our blog for a technical analysis: bishopfox.com/blog/strongs...

0
0
0
7h ago

CVE-2020-8561

Overview

Kubernetes
Kubernetes

20 Sep 2021

Published

16 Sep 2024

Updated

CVSS v3.1

MEDIUM (4.1)

EPSS

0.18%

MITRE

KEV

Description

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

Statistics

2 Posts
2 Interactions

Last activity: 4 hours ago

Fediverse

Rory McCune @raesene

Just released another entry in my blog series looking at the unpatchable vulnerabilities of Kubernetes.

Whilst the CVEs are quite old, understanding them is useful, both to understand if you need to apply mitigations and also for some of the low-level Kubernetes implementation details they involve.

https://securitylabs.datadoghq.com/articles/unpatchable-kubernetes-vulnerabilities-cve-2020-8561/

2
0
0
7h ago

Bluesky

Cybersecurity News Everyday @hendryadrian.bsky.social

CVE-2020-8561 exploits an SSRF flaw in Kubernetes API server’s ValidatingWebhookConfiguration and profiling endpoints to expose full responses. Requires cluster-admin creds to escalate impact. #KubernetesSecurity #SSRF #CVE20208561

0
0
0
4h ago

CVE-2026-20817

Overview

Microsoft
Windows 10 Version 21H2

13 Jan 2026

Published

26 Feb 2026

Updated

CVSS v3.1

HIGH (7.8)

EPSS

0.02%

MITRE

KEV

Description

Improper handling of insufficient permissions or privileges in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Statistics

3 Posts
1 Interaction

Last activity: 9 hours ago

Bluesky

Undercode Testing @undercode.bsky.social

SYSTEM Takeover: New Windows Error Reporting Flaw (CVE-2026-20817) Demands Immediate Action + Video Introduction: The Windows Error Reporting (WER) service, a critical component designed to capture crash dumps and telemetry, has become the latest attack vector for privilege escalation. Security…

0
1
0
9h ago

CrowdCyber @crowdcyber.bsky.social

Proof-of-Concept Released: Public Exploit Details for Windows Error Reporting LPE (CVE-2026-20817)

0
0
0
16h ago

Undercode Testing @undercode.bsky.social

CVE-2026-20817: Windows Error Reporting Goes Nuclear – How a Single Flaw Forced Microsoft to Nuke Its Own Feature + Video Introduction: A recently patched Elevation of Privilege (EoP) vulnerability in the Windows Error Reporting (WER) service, tracked as CVE-2026-20817, has exposed a critical flaw…

0
0
0
10h ago

CVE-2026-21992

Overview

Oracle Corporation
Oracle Identity Manager

20 Mar 2026

Published

24 Mar 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

0.06%

MITRE

KEV

Description

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager and Oracle Web Services Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager and Oracle Web Services Manager. Note: Oracle Web Services Manager is installed with an Oracle Fusion Middleware Infrastructure. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Statistics

2 Posts

Last activity: 22 hours ago

Bluesky

Lorenzo Ordóñez @lordman1982.bsky.social

Oracle Patches Critical CVE-2026-21992 Enabling Unauthenticated RCE in Identity Manager thehackernews.com/2026/03/orac...

0
0
0
22h ago

piggo @pigondrugs.bsky.social

~Talos~ Talos highlights identity-centric attacks in 2025, plus alerts for Oracle CVE-2026-21992 and PureLog Stealer. - IOCs: CVE-2026-21992, PureLog Stealer, Qilin - #CVE202621992 #CyberSecurity #ThreatIntel

0
0
0
22h ago

CVE-2026-4681

Overview

PTC
Windchill PDMLink

23 Mar 2026

Published

24 Mar 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

0.38%

MITRE

KEV

Description

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.

Statistics

2 Posts

Last activity: 2 hours ago

Fediverse

Offensive Sequence @offseq

🚨 CRITICAL: CISA flags CVE-2026-4681 in PTC Windchill PLM. German police issued physical warnings — high urgency! No active exploits, but risk to manufacturing & engineering data is severe. Audit & secure now. https://radar.offseq.com/threat/cisa-flags-critical-ptc-vulnerability-that-had-ger-e5854258 #OffSeq #Vulnerability #PLM #InfoSec

0
0
0
7h ago

CyberNetsecIO @netsecio

📰 Police Physically Warn Firms of Critical Unpatched RCE Flaw in PTC Windchill

🚨 CRITICAL FLAW: German police physically warn companies about a 10.0 CVSS RCE bug (CVE-2026-4681) in PTC Windchill & FlexPLM. CISA issues alert. No patch yet! ⚠️ #CVE20264681 #ZeroDay #Manufacturing

🔗 https://cyber.netsecops.io/articles/critical-ptc-windchill-flaw-triggers-unprecedented-police-mobilization-in-germany/?utm_source=mastodon&utm_medium=social&utm_campaign=twitter_auto

0
0
0
2h ago

CVE-2026-33701

Overview

open-telemetry
opentelemetry-java-instrumentation

27 Mar 2026

Published

27 Mar 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

0.50%

MITRE

KEV

Description

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, OpenTelemetry Java instrumentation is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable. Third, gadget-chain-compatible library is present on the classpath. This results in arbitrary remote code execution with the privileges of the user running the instrumented JVM. For JDK >= 17, no action is required, but upgrading is strongly encouraged. For JDK < 17, upgrade to version 2.26.1 or later. As a workaround, set the system property `-Dotel.instrumentation.rmi.enabled=false` to disable the RMI integration.

Statistics

1 Post
4 Interactions

Last activity: 15 hours ago

Fediverse

Offensive Sequence @offseq

🚨 CRITICAL: CVE-2026-33701 affects opentelemetry-java-instrumentation <2.26.1. Unauthenticated RCE possible on Java ≤16 via unsafe RMI deserialization. Upgrade to 2.26.1+ or disable RMI now! Details: https://radar.offseq.com/threat/cve-2026-33701-cwe-502-deserialization-of-untruste-08578920 #OffSeq #Java #RCE #Vuln

3
1
0
15h ago

CVE-2026-4368

Overview

NetScaler
ADC

23 Mar 2026

Published

24 Mar 2026

Updated

CVSS v4.0

HIGH (7.7)

EPSS

0.02%

MITRE

KEV

Description

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup

Statistics

3 Posts
1 Interaction

Last activity: 4 hours ago

Fediverse

Andi @Andi

Zwei kritische Schwachstellen beherrschen die Lage für deutsche Unternehmen.
Das BSI warnt vor einer aktiv ausgenutzten Lücke in Microsoft SharePoint. Die CISA hatte die Schwachstelle am 18. März in ihren Katalog ausgenutzter Sicherheitslücken aufgenommen. CERT-EU veröffentlichte am 25. März ein Advisory und verwies auf Maßnahmen aus der ToolShell-Angriffskampagne des Vorjahres. Der CVSS-Score liegt bei 9.8 von 10 und wurde hochgestuft, nachdem sich herausstellte, dass eine Ausnutzung auch ohne Authentifizierung möglich ist.
Parallel dazu hat CERT-Bund am 24. März Alarm wegen zweier Schwachstellen in Citrix NetScaler ADC und NetScaler Gateway geschlagen. CVE-2026-3055 ermöglicht es nicht authentifizierten Angreifern, aktive Session-Token aus dem Speicher betroffener Geräte auszulesen. CVE-2026-4368 kann durch eine Race Condition zur Übernahme fremder Benutzersitzungen führen. Besonders gefährdet sind Systeme, die als SAML Identity Provider konfiguriert sind, also eine in Unternehmensumgebungen weit verbreitete Konfiguration für Single Sign-On. Sicherheitsforscher bewerten eine baldige aktive Ausnutzung als sehr wahrscheinlich.
Sofortmaßnahmen: SharePoint patchen, NetScaler aktualisieren und aktiven Sessions beenden.

Cybersicherheitswarnung 2026-238220-1032 (25.03.2026) | CERT-Bund WID-SEC-2026-0836 (24.03.2026)
CVE-2026-20963 | CVE-2026-3055 | CVE-2026-4368
#Informationssicherheit #CISO #BSI #SharePoint #Citrix #NetScaler #Patchmanagement #NIS2 #CyberSecurity #ITSicherheit

0
0
0
4h ago

Bluesky

Eyal Estrin ☁️ @eyalestrin.bsky.social

Articles about Citrix NetScaler vulnerabilities CVE-2026-3055 and CVE-2026-4368 (26.3.2026) #patchmanagement

0
0
0
22h ago

OpsMatters @opsmatters.com

The latest update for #CyCognito includes "Citrix NetScaler ADC and Gateway Vulnerabilities (CVE-2026-3055 & CVE-2026-4368)" and "Emerging Threat: Ubiquiti UniFi Network Application Path Traversal (CVE-2026-22557)". #cybersecurity #AttackSurfaceManagement #EASM https://opsmtrs.com/44Srq0X

0
1
0
17h ago