Exploit / PoCcriticalExploited in the wild

U.S. CISA adds DD-WRT, Langflow and WordPress flaws to its Known Exploited Vulnerabilities catalog

Security Affairsby @securityaffairsJul 22, 2026 · 10:45 UTC (Jul 22, 2026)2 min read1 · 1 read

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-27137 CVE-2026-0770 CVE-2026-63030 CVE-2026-60137

Tags: cve-2021-27137 cve-2026-0770 cve-2026-60137 cve-2026-63030 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-27137	Unauthenticated Stack-Based Buffer Overflow in DD-WRT UPnP (SSDP M-SEARCH)	8.1	4%	KEVPoC ×4	Jul 16, 2026 KEV Jul 21, 2026
CVE-2026-0770	Unauthenticated Remote Code Execution in Langflow validate Endpoint	9.8	63%	KEV	Jan 23, 2026 KEV Jul 21, 2026
CVE-2026-63030 +1 related CVE CVE-2026-60137	WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE	9.8 group max	11%	KEVPoC ×7	Jul 17, 2026 KEV Jul 21, 2026

From the original article

2 min read at securityaffairs.com

U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds DD-WRT, Langflow, and WordPress flaws to its Known Exploited Vulnerabilities catalog.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.