#cisa-kev

2 articles

An AI app-builder is being mass-exploited — 650 attempts from 41 countries against one Langflow bug

2026-08-09AI

CVE-2026-9198 gives unauthenticated remote code execution on default Langflow deployments, and it was patched in July. Telemetry recorded 650 exploitation attempts from 244 IPs before CISA added it to the KEV catalog on 5 August.

N-able patched an auth bypass in N-central. The patch was incomplete, and attackers came back through the same door

2026-08-09Security

CVE-2026-18577 exists because the fix for CVE-2026-18556 didn't finish the job. Both are being exploited, and N-central sits at the top of MSP estates — admin on the server means Take Control access to every endpoint underneath it.