CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-3248 | Unauthenticated RCE in Langflow /api/v1/validate/code | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2025-34291 | CORS Origin Validation Flaw in Langflow Enables Account Takeover and RCE | 9.4 | 93% | KEVPoC | KEV |
| CVE-2026-0770 | Unauthenticated Remote Code Execution in Langflow validate Endpoint | 9.8 | 63% | KEV | KEV |
| CVE-2026-21445 | Missing Authentication Controls in Langflow API Exposes User Data | 8.8 | 33% | PoC | |
| CVE-2026-33017 | Unauthenticated RCE in Langflow AI Workflow Builder | 9.3 | 96% | KEVPoC ×6 | KEV |
| CVE-2026-48282 | Path Traversal Leading to RCE in Adobe ColdFusion | 10.0 | 42% | KEV | KEV |
| CVE-2026-48908 | Unauthenticated File Upload RCE in JoomShaper SP Page Builder for Joomla | 10.0 | 89% | KEVPoC | KEV |
| CVE-2026-5027 | Authenticated Path Traversal Arbitrary File Write in Langflow Files API | 8.8 | 36% | ||
| CVE-2026-55255 | IDOR Authorization Bypass in Langflow Lets Attackers Run Other Users' Flows | 8.4 | <1% | KEVPoC | KEV |
| CVE-2026-56290 | Improper Access Control Enables Unauthenticated RCE in Joomlack Page Builder | 10.0 | 31% | KEVPoC | KEV |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Jul 08, 2026 AI Security / Vulnerability The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four security flaws to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.