https://vulnerability.circl.lu/sightings/feed 2026-09-17T12:00:03.535569+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/276f51cc-f9d6-4576-b827-b0f26d25aefb/export 2026-09-17T12:00:03.548049+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "276f51cc-f9d6-4576-b827-b0f26d25aefb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0770", "type": "seen", "source": "https://bsky.app/profile/greynoise.infosec.exchange.ap.brid.gy/post/3mvniypzuabu2", "content": "Two remote code execution flaws that CISA lists as known exploited turned up this week inside ordinary commodity crawling.\n\nAdversaries attempted CVE-2025-3248 and CVE-2026-0770 in Langflow, the AI application platform, at 3,968 and 4,770 connection attempts [\u2026] \n\n[Original post on infosec.exchange]", "creation_timestamp": "2026-09-16T15:58:51.469307Z"} 2026-09-16T15:58:51.469307+00:00 https://vulnerability.circl.lu/sighting/e1d2bb68-40a0-4af6-a4ce-23854dcb113d/export 2026-09-17T12:00:03.550603+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "e1d2bb68-40a0-4af6-a4ce-23854dcb113d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0770", "type": "seen", "source": "https://infosec.exchange/users/greynoise/statuses/117281541720935473", "content": "Two remote code execution flaws that CISA lists as known exploited turned up this week inside ordinary commodity crawling.\nAdversaries attempted CVE-2025-3248 and CVE-2026-0770 in Langflow, the AI application platform, at 3,968 and 4,770 connection attempts, both new to this brief series. The addresses behind them are the interesting part. Every one of them also carries a generic web crawling tag, roughly nine in ten collected environment files and enumerated WordPress installations, and about four in five requested repository configuration in the same window. Two hosting providers supply roughly 95% of those addresses, which means the source count measures how that traffic leaves those networks. A sweep of that shape reaches any exposed Langflow instance a general crawler touches.\nThe rest of the week concentrated the same way. Five of the ten highest-volume sources ran SSH enumeration and credential attacks from consumer broadband and mobile carrier networks, and four of them carried 36% of all alternative-port SSH crawling we observed. Two shared client fingerprints group those four across four separate networks, marking a common tool class. One address supplied more than half of all Remote Desktop crawling observed and three fifths of the credential attempts inside it.\nGreyNoise customers get the full weekly brief. Our public At The Edge one-page: https://www.greynoise.io/resources/at-the-edge-clear-091426", "creation_timestamp": "2026-09-16T15:58:27.086571Z"} 2026-09-16T15:58:27.086571+00:00 https://vulnerability.circl.lu/sighting/1d177ba6-5d21-4ebf-84df-e9b1a1beb9f2/export 2026-09-17T12:00:03.550756+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "1d177ba6-5d21-4ebf-84df-e9b1a1beb9f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-0777", "type": "seen", "source": "https://bsky.app/profile/grosservo.bsky.social/post/3mvkbfzwehs2u", "content": "SFTP, the secure file transfer protocol is based on SSH.\nMost software vendors don't re-implement the SSH stack in their products and use SSH stacks of the market, many of which have known vulnerabilities.\nA famous one was CVE-2016-0777 whereby the key could be extracted through MITM attack.", "creation_timestamp": "2026-09-15T09:04:54.150072Z"} 2026-09-15T09:04:54.150072+00:00 https://vulnerability.circl.lu/sighting/6e3a158b-e662-45b2-aff3-6ba47266d041/export 2026-09-17T12:00:03.550870+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "6e3a158b-e662-45b2-aff3-6ba47266d041", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0770", "type": "published-proof-of-concept", "source": "https://t.me/CYPERMRED/132", "content": "\ud83d\udea8 CVE-2026-0770 | \u062b\u063a\u0631\u0629 \u062d\u0631\u062c\u0629 \u0641\u064a \u0645\u0646\u0635\u0629 Langflow\n\n\u26a0\ufe0f \u0627\u0644\u062e\u0637\u0648\u0631\u0629: 9.8/10 (\u062d\u0631\u062c\u0629 \u062c\u062f\u0627\u064b)\n\ud83d\udcc5 \u0627\u0644\u0627\u0643\u062a\u0634\u0627\u0641: \u064a\u0648\u0646\u064a\u0648 2026 | CISA \u0623\u0636\u0627\u0641\u062a\u0647\u0627: 21 \u064a\u0648\u0644\u064a\u0648 2026\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u2753 \u0645\u0627 \u0647\u064a Langflow\u061f\n\u0645\u0646\u0635\u0629 \u0645\u0641\u062a\u0648\u062d\u0629 \u0627\u0644\u0645\u0635\u062f\u0631 \u0644\u0628\u0646\u0627\u0621 AI Agents \u0648\u062e\u0637\u0648\u0637 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 (Workflows) \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 LLMs.\n\n\u2753 \u0645\u0627 \u0647\u064a \u0627\u0644\u062b\u063a\u0631\u0629\u061f\n\u0646\u0642\u0637\u0629 \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0627\u0644\u0643\u0648\u062f /api/v1/validate/code \u0643\u0627\u0646\u062a \u062a\u0633\u062a\u062e\u062f\u0645 exec() \u0628\u062f\u0644 compile() \u0641\u0642\u0637.\n\n\u0627\u0644\u0647\u0627\u0643\u0631 \u064a\u0631\u0633\u0644 \u0643\u0648\u062f Python \u0628\u0633\u064a\u0637 \u2014 \u0627\u0644\u0645\u0646\u0635\u0629 \"\u062a\u0641\u062d\u0635\u0647\" \u2014 \u0648\u0627\u0644\u0643\u0648\u062f \u064a\u0646\u0641\u0630 \u062a\u0644\u0642\u0627\u0626\u064a\u0627\u064b!\n\n\ud83d\udca1 \u0645\u062b\u0627\u0644 \u0628\u0633\u064a\u0637:\ndef pwn(x=import('os').system('id')):\n pass\n\n\u0647\u0630\u0627 \u0627\u0644\u0643\u0648\u062f \"\u0645\u0627 \u064a\u062a\u0645 \u0627\u0633\u062a\u062f\u0639\u0627\u0624\u0647\" \u2014 \u0628\u0633 \u062a\u0639\u0631\u064a\u0641\u0647 \u064a\u0646\u0641\u0630 \u0627\u0644\u0623\u0645\u0631 id \u0639\u0644\u0649 \u0627\u0644\u0633\u064a\u0631\u0641\u0631!\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udd34 \u0644\u0645\u0627\u0630\u0627 \u062e\u0637\u064a\u0631\u0629\u061f\n\u2022 \u0644\u0627 \u062a\u062d\u062a\u0627\u062c \u062a\u0633\u062c\u064a\u0644 \u062f\u062e\u0648\u0644 (Unauthenticated)\n\u2022 \u0637\u0644\u0628 POST \u0648\u0627\u062d\u062f \u0643\u0627\u0641\u064a\n\u2022 \u062a\u0646\u0641\u0630 \u0628\u0635\u0644\u0627\u062d\u064a\u0627\u062a root \u0641\u064a \u0627\u0644\u063a\u0627\u0644\u0628\n\u2022 \u062a\u0633\u0631\u0642: \u0645\u0641\u0627\u062a\u064a\u062d AWS\u060c \u0628\u064a\u0627\u0646\u0627\u062a Kubernetes\u060c \u0645\u062a\u063a\u064a\u0631\u0627\u062a \u0627\u0644\u0628\u064a\u0626\u0629\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udee1 \u0627\u0644\u062d\u0645\u0627\u064a\u0629:\n1\ufe0f\u20e3 \u062d\u062f\u0651\u062b Langflow \u0644\u0640 1.10.1 \u0641\u0648\u0631\u0627\u064b\n2\ufe0f\u20e3 \u0627\u0641\u062d\u0635 \u0627\u0644\u0633\u062c\u0644\u0627\u062a \u0644\u0640 /api/v1/validate/code \u0645\u0646\u0630 27 \u064a\u0648\u0646\u064a\u0648\n3\ufe0f\u20e3 \u063a\u064a\u0651\u0631 \u062c\u0645\u064a\u0639 \u0627\u0644\u0645\u0641\u0627\u062a\u064a\u062d \u0648\u0627\u0644\u0643\u0644\u0645\u0627\u062a \u0627\u0644\u0633\u0631\u064a\u0629\n4\ufe0f\u20e3 \u0644\u0627 \u062a\u0639\u0631\u0636 Langflow \u0639\u0644\u0649 \u0627\u0644\u0625\u0646\u062a\u0631\u0646\u062a \u0627\u0644\u0645\u0641\u062a\u0648\u062d\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udcca \u0633\u0644\u0633\u0644\u0629 \u0627\u0644\u0647\u062c\u0648\u0645 (Attack Chain):\n1. \u0627\u0644\u0628\u062d\u062b \u0639\u0646 \u0633\u064a\u0631\u0641\u0631\u0627\u062a Langflow \u0627\u0644\u0645\u0643\u0634\u0648\u0641\u0629\n2. \u0625\u0631\u0633\u0627\u0644 \u0643\u0648\u062f \u062e\u0628\u064a\u062b \u0644\u0644\u062a\u062d\u0642\u0642\n3. \u062a\u0646\u0641\u064a\u0630 \u0623\u0648\u0627\u0645\u0631 \u0627\u0644\u0646\u0638\u0627\u0645\n4. \u0633\u0631\u0642\u0629 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0640 Cloud\n5. \u0646\u0634\u0631 Malware \u0623\u0648 Cryptominer\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udd17 \u0627\u0644\u0645\u0635\u062f\u0631: resecurity.com\n\ud83d\udce4 \u0634\u0627\u0631\u0643 \u0645\u0639 \u0641\u0631\u064a\u0642 DevOps/Security \u0639\u0646\u062f\u0643\n\ud83d\udcac \u0647\u0644 \u062a\u0633\u062a\u062e\u062f\u0645 Langflow\u061f \u0627\u0643\u062a\u0628 \u0644\u0646\u0627 \ud83d\udc47\n\n#CVE2026_0770 #Langflow #RCE #Cybersecurity t.me/CYPERMRED", "creation_timestamp": "2026-09-14T00:00:11.216318Z"} 2026-09-14T00:00:11.216318+00:00 https://vulnerability.circl.lu/sighting/e7f1da9c-4722-4911-afd4-9634f1fdde2c/export 2026-09-17T12:00:03.551011+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "e7f1da9c-4722-4911-afd4-9634f1fdde2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0770", "type": "published-proof-of-concept", "source": "https://t.me/CYPERMRED/133", "content": "\ud83d\udea8 CVE-2026-0770 | \u062b\u063a\u0631\u0629 \u062d\u0631\u062c\u0629 \u0641\u064a \u0645\u0646\u0635\u0629 Langflow\n\n\u26a0\ufe0f \u0627\u0644\u062e\u0637\u0648\u0631\u0629: 9.8/10 (\u062d\u0631\u062c\u0629 \u062c\u062f\u0627\u064b)\n\ud83d\udcc5 \u0627\u0644\u0627\u0643\u062a\u0634\u0627\u0641: \u064a\u0648\u0646\u064a\u0648 2026 | CISA \u0623\u0636\u0627\u0641\u062a\u0647\u0627: 21 \u064a\u0648\u0644\u064a\u0648 2026\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u2753 \u0645\u0627 \u0647\u064a Langflow\u061f\n\u0645\u0646\u0635\u0629 \u0645\u0641\u062a\u0648\u062d\u0629 \u0627\u0644\u0645\u0635\u062f\u0631 \u0644\u0628\u0646\u0627\u0621 AI Agents \u0648\u062e\u0637\u0648\u0637 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 (Workflows) \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 LLMs.\n\n\u2753 \u0645\u0627 \u0647\u064a \u0627\u0644\u062b\u063a\u0631\u0629\u061f\n\u0646\u0642\u0637\u0629 \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0627\u0644\u0643\u0648\u062f /api/v1/validate/code \u0643\u0627\u0646\u062a \u062a\u0633\u062a\u062e\u062f\u0645 exec() \u0628\u062f\u0644 compile() \u0641\u0642\u0637.\n\n\u0627\u0644\u0647\u0627\u0643\u0631 \u064a\u0631\u0633\u0644 \u0643\u0648\u062f Python \u0628\u0633\u064a\u0637 \u2014 \u0627\u0644\u0645\u0646\u0635\u0629 \"\u062a\u0641\u062d\u0635\u0647\" \u2014 \u0648\u0627\u0644\u0643\u0648\u062f \u064a\u0646\u0641\u0630 \u062a\u0644\u0642\u0627\u0626\u064a\u0627\u064b!\n\n\ud83d\udca1 \u0645\u062b\u0627\u0644 \u0628\u0633\u064a\u0637:\ndef pwn(x=import('os').system('id')):\n pass\n\n\u0647\u0630\u0627 \u0627\u0644\u0643\u0648\u062f \"\u0645\u0627 \u064a\u062a\u0645 \u0627\u0633\u062a\u062f\u0639\u0627\u0624\u0647\" \u2014 \u0628\u0633 \u062a\u0639\u0631\u064a\u0641\u0647 \u064a\u0646\u0641\u0630 \u0627\u0644\u0623\u0645\u0631 id \u0639\u0644\u0649 \u0627\u0644\u0633\u064a\u0631\u0641\u0631!\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udd34 \u0644\u0645\u0627\u0630\u0627 \u062e\u0637\u064a\u0631\u0629\u061f\n\u2022 \u0644\u0627 \u062a\u062d\u062a\u0627\u062c \u062a\u0633\u062c\u064a\u0644 \u062f\u062e\u0648\u0644 (Unauthenticated)\n\u2022 \u0637\u0644\u0628 POST \u0648\u0627\u062d\u062f \u0643\u0627\u0641\u064a\n\u2022 \u062a\u0646\u0641\u0630 \u0628\u0635\u0644\u0627\u062d\u064a\u0627\u062a root \u0641\u064a \u0627\u0644\u063a\u0627\u0644\u0628\n\u2022 \u062a\u0633\u0631\u0642: \u0645\u0641\u0627\u062a\u064a\u062d AWS\u060c \u0628\u064a\u0627\u0646\u0627\u062a Kubernetes\u060c \u0645\u062a\u063a\u064a\u0631\u0627\u062a \u0627\u0644\u0628\u064a\u0626\u0629\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udee1 \u0627\u0644\u062d\u0645\u0627\u064a\u0629:\n1\ufe0f\u20e3 \u062d\u062f\u0651\u062b Langflow \u0644\u0640 1.10.1 \u0641\u0648\u0631\u0627\u064b\n2\ufe0f\u20e3 \u0627\u0641\u062d\u0635 \u0627\u0644\u0633\u062c\u0644\u0627\u062a \u0644\u0640 /api/v1/validate/code \u0645\u0646\u0630 27 \u064a\u0648\u0646\u064a\u0648\n3\ufe0f\u20e3 \u063a\u064a\u0651\u0631 \u062c\u0645\u064a\u0639 \u0627\u0644\u0645\u0641\u0627\u062a\u064a\u062d \u0648\u0627\u0644\u0643\u0644\u0645\u0627\u062a \u0627\u0644\u0633\u0631\u064a\u0629\n4\ufe0f\u20e3 \u0644\u0627 \u062a\u0639\u0631\u0636 Langflow \u0639\u0644\u0649 \u0627\u0644\u0625\u0646\u062a\u0631\u0646\u062a \u0627\u0644\u0645\u0641\u062a\u0648\u062d\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udcca \u0633\u0644\u0633\u0644\u0629 \u0627\u0644\u0647\u062c\u0648\u0645 (Attack Chain):\n1. \u0627\u0644\u0628\u062d\u062b \u0639\u0646 \u0633\u064a\u0631\u0641\u0631\u0627\u062a Langflow \u0627\u0644\u0645\u0643\u0634\u0648\u0641\u0629\n2. \u0625\u0631\u0633\u0627\u0644 \u0643\u0648\u062f \u062e\u0628\u064a\u062b \u0644\u0644\u062a\u062d\u0642\u0642\n3. \u062a\u0646\u0641\u064a\u0630 \u0623\u0648\u0627\u0645\u0631 \u0627\u0644\u0646\u0638\u0627\u0645\n4. \u0633\u0631\u0642\u0629 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0640 Cloud\n5. \u0646\u0634\u0631 Malware \u0623\u0648 Cryptominer", "creation_timestamp": "2026-09-14T00:00:11.166321Z"} 2026-09-14T00:00:11.166321+00:00 https://vulnerability.circl.lu/sighting/31ef10a9-6783-4344-b9e2-704c51029397/export 2026-09-17T12:00:03.551134+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "31ef10a9-6783-4344-b9e2-704c51029397", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0770", "type": "published-proof-of-concept", "source": "https://t.me/CYPERMRED/132", "content": "\ud83d\udea8 CVE-2026-0770 | \u062b\u063a\u0631\u0629 \u062d\u0631\u062c\u0629 \u0641\u064a \u0645\u0646\u0635\u0629 Langflow\n\n\u26a0\ufe0f \u0627\u0644\u062e\u0637\u0648\u0631\u0629: 9.8/10 (\u062d\u0631\u062c\u0629 \u062c\u062f\u0627\u064b)\n\ud83d\udcc5 \u0627\u0644\u0627\u0643\u062a\u0634\u0627\u0641: \u064a\u0648\u0646\u064a\u0648 2026 | CISA \u0623\u0636\u0627\u0641\u062a\u0647\u0627: 21 \u064a\u0648\u0644\u064a\u0648 2026\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u2753 \u0645\u0627 \u0647\u064a Langflow\u061f\n\u0645\u0646\u0635\u0629 \u0645\u0641\u062a\u0648\u062d\u0629 \u0627\u0644\u0645\u0635\u062f\u0631 \u0644\u0628\u0646\u0627\u0621 AI Agents \u0648\u062e\u0637\u0648\u0637 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 (Workflows) \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 LLMs.\n\n\u2753 \u0645\u0627 \u0647\u064a \u0627\u0644\u062b\u063a\u0631\u0629\u061f\n\u0646\u0642\u0637\u0629 \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0627\u0644\u0643\u0648\u062f /api/v1/validate/code \u0643\u0627\u0646\u062a \u062a\u0633\u062a\u062e\u062f\u0645 exec() \u0628\u062f\u0644 compile() \u0641\u0642\u0637.\n\n\u0627\u0644\u0647\u0627\u0643\u0631 \u064a\u0631\u0633\u0644 \u0643\u0648\u062f Python \u0628\u0633\u064a\u0637 \u2014 \u0627\u0644\u0645\u0646\u0635\u0629 \"\u062a\u0641\u062d\u0635\u0647\" \u2014 \u0648\u0627\u0644\u0643\u0648\u062f \u064a\u0646\u0641\u0630 \u062a\u0644\u0642\u0627\u0626\u064a\u0627\u064b!\n\n\ud83d\udca1 \u0645\u062b\u0627\u0644 \u0628\u0633\u064a\u0637:\ndef pwn(x=import('os').system('id')):\n pass\n\n\u0647\u0630\u0627 \u0627\u0644\u0643\u0648\u062f \"\u0645\u0627 \u064a\u062a\u0645 \u0627\u0633\u062a\u062f\u0639\u0627\u0624\u0647\" \u2014 \u0628\u0633 \u062a\u0639\u0631\u064a\u0641\u0647 \u064a\u0646\u0641\u0630 \u0627\u0644\u0623\u0645\u0631 id \u0639\u0644\u0649 \u0627\u0644\u0633\u064a\u0631\u0641\u0631!\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udd34 \u0644\u0645\u0627\u0630\u0627 \u062e\u0637\u064a\u0631\u0629\u061f\n\u2022 \u0644\u0627 \u062a\u062d\u062a\u0627\u062c \u062a\u0633\u062c\u064a\u0644 \u062f\u062e\u0648\u0644 (Unauthenticated)\n\u2022 \u0637\u0644\u0628 POST \u0648\u0627\u062d\u062f \u0643\u0627\u0641\u064a\n\u2022 \u062a\u0646\u0641\u0630 \u0628\u0635\u0644\u0627\u062d\u064a\u0627\u062a root \u0641\u064a \u0627\u0644\u063a\u0627\u0644\u0628\n\u2022 \u062a\u0633\u0631\u0642: \u0645\u0641\u0627\u062a\u064a\u062d AWS\u060c \u0628\u064a\u0627\u0646\u0627\u062a Kubernetes\u060c \u0645\u062a\u063a\u064a\u0631\u0627\u062a \u0627\u0644\u0628\u064a\u0626\u0629\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udee1 \u0627\u0644\u062d\u0645\u0627\u064a\u0629:\n1\ufe0f\u20e3 \u062d\u062f\u0651\u062b Langflow \u0644\u0640 1.10.1 \u0641\u0648\u0631\u0627\u064b\n2\ufe0f\u20e3 \u0627\u0641\u062d\u0635 \u0627\u0644\u0633\u062c\u0644\u0627\u062a \u0644\u0640 /api/v1/validate/code \u0645\u0646\u0630 27 \u064a\u0648\u0646\u064a\u0648\n3\ufe0f\u20e3 \u063a\u064a\u0651\u0631 \u062c\u0645\u064a\u0639 \u0627\u0644\u0645\u0641\u0627\u062a\u064a\u062d \u0648\u0627\u0644\u0643\u0644\u0645\u0627\u062a \u0627\u0644\u0633\u0631\u064a\u0629\n4\ufe0f\u20e3 \u0644\u0627 \u062a\u0639\u0631\u0636 Langflow \u0639\u0644\u0649 \u0627\u0644\u0625\u0646\u062a\u0631\u0646\u062a \u0627\u0644\u0645\u0641\u062a\u0648\u062d\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udcca \u0633\u0644\u0633\u0644\u0629 \u0627\u0644\u0647\u062c\u0648\u0645 (Attack Chain):\n1. \u0627\u0644\u0628\u062d\u062b \u0639\u0646 \u0633\u064a\u0631\u0641\u0631\u0627\u062a Langflow \u0627\u0644\u0645\u0643\u0634\u0648\u0641\u0629\n2. \u0625\u0631\u0633\u0627\u0644 \u0643\u0648\u062f \u062e\u0628\u064a\u062b \u0644\u0644\u062a\u062d\u0642\u0642\n3. \u062a\u0646\u0641\u064a\u0630 \u0623\u0648\u0627\u0645\u0631 \u0627\u0644\u0646\u0638\u0627\u0645\n4. \u0633\u0631\u0642\u0629 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0640 Cloud\n5. \u0646\u0634\u0631 Malware \u0623\u0648 Cryptominer\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udd17 \u0627\u0644\u0645\u0635\u062f\u0631: resecurity.com\n\ud83d\udce4 \u0634\u0627\u0631\u0643 \u0645\u0639 \u0641\u0631\u064a\u0642 DevOps/Security \u0639\u0646\u062f\u0643\n\ud83d\udcac \u0647\u0644 \u062a\u0633\u062a\u062e\u062f\u0645 Langflow\u061f \u0627\u0643\u062a\u0628 \u0644\u0646\u0627 \ud83d\udc47\n\n#CVE2026_0770 #Langflow #RCE #Cybersecurity t.me/CYPERMRED", "creation_timestamp": "2026-09-13T20:00:05.151414Z"} 2026-09-13T20:00:05.151414+00:00 https://vulnerability.circl.lu/sighting/f4ef3acf-3a25-445e-bbb2-4946812355d6/export 2026-09-17T12:00:03.551249+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "f4ef3acf-3a25-445e-bbb2-4946812355d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0770", "type": "published-proof-of-concept", "source": "https://t.me/CYPERMRED/133", "content": "\ud83d\udea8 CVE-2026-0770 | \u062b\u063a\u0631\u0629 \u062d\u0631\u062c\u0629 \u0641\u064a \u0645\u0646\u0635\u0629 Langflow\n\n\u26a0\ufe0f \u0627\u0644\u062e\u0637\u0648\u0631\u0629: 9.8/10 (\u062d\u0631\u062c\u0629 \u062c\u062f\u0627\u064b)\n\ud83d\udcc5 \u0627\u0644\u0627\u0643\u062a\u0634\u0627\u0641: \u064a\u0648\u0646\u064a\u0648 2026 | CISA \u0623\u0636\u0627\u0641\u062a\u0647\u0627: 21 \u064a\u0648\u0644\u064a\u0648 2026\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u2753 \u0645\u0627 \u0647\u064a Langflow\u061f\n\u0645\u0646\u0635\u0629 \u0645\u0641\u062a\u0648\u062d\u0629 \u0627\u0644\u0645\u0635\u062f\u0631 \u0644\u0628\u0646\u0627\u0621 AI Agents \u0648\u062e\u0637\u0648\u0637 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 (Workflows) \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 LLMs.\n\n\u2753 \u0645\u0627 \u0647\u064a \u0627\u0644\u062b\u063a\u0631\u0629\u061f\n\u0646\u0642\u0637\u0629 \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0627\u0644\u0643\u0648\u062f /api/v1/validate/code \u0643\u0627\u0646\u062a \u062a\u0633\u062a\u062e\u062f\u0645 exec() \u0628\u062f\u0644 compile() \u0641\u0642\u0637.\n\n\u0627\u0644\u0647\u0627\u0643\u0631 \u064a\u0631\u0633\u0644 \u0643\u0648\u062f Python \u0628\u0633\u064a\u0637 \u2014 \u0627\u0644\u0645\u0646\u0635\u0629 \"\u062a\u0641\u062d\u0635\u0647\" \u2014 \u0648\u0627\u0644\u0643\u0648\u062f \u064a\u0646\u0641\u0630 \u062a\u0644\u0642\u0627\u0626\u064a\u0627\u064b!\n\n\ud83d\udca1 \u0645\u062b\u0627\u0644 \u0628\u0633\u064a\u0637:\ndef pwn(x=import('os').system('id')):\n pass\n\n\u0647\u0630\u0627 \u0627\u0644\u0643\u0648\u062f \"\u0645\u0627 \u064a\u062a\u0645 \u0627\u0633\u062a\u062f\u0639\u0627\u0624\u0647\" \u2014 \u0628\u0633 \u062a\u0639\u0631\u064a\u0641\u0647 \u064a\u0646\u0641\u0630 \u0627\u0644\u0623\u0645\u0631 id \u0639\u0644\u0649 \u0627\u0644\u0633\u064a\u0631\u0641\u0631!\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udd34 \u0644\u0645\u0627\u0630\u0627 \u062e\u0637\u064a\u0631\u0629\u061f\n\u2022 \u0644\u0627 \u062a\u062d\u062a\u0627\u062c \u062a\u0633\u062c\u064a\u0644 \u062f\u062e\u0648\u0644 (Unauthenticated)\n\u2022 \u0637\u0644\u0628 POST \u0648\u0627\u062d\u062f \u0643\u0627\u0641\u064a\n\u2022 \u062a\u0646\u0641\u0630 \u0628\u0635\u0644\u0627\u062d\u064a\u0627\u062a root \u0641\u064a \u0627\u0644\u063a\u0627\u0644\u0628\n\u2022 \u062a\u0633\u0631\u0642: \u0645\u0641\u0627\u062a\u064a\u062d AWS\u060c \u0628\u064a\u0627\u0646\u0627\u062a Kubernetes\u060c \u0645\u062a\u063a\u064a\u0631\u0627\u062a \u0627\u0644\u0628\u064a\u0626\u0629\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udee1 \u0627\u0644\u062d\u0645\u0627\u064a\u0629:\n1\ufe0f\u20e3 \u062d\u062f\u0651\u062b Langflow \u0644\u0640 1.10.1 \u0641\u0648\u0631\u0627\u064b\n2\ufe0f\u20e3 \u0627\u0641\u062d\u0635 \u0627\u0644\u0633\u062c\u0644\u0627\u062a \u0644\u0640 /api/v1/validate/code \u0645\u0646\u0630 27 \u064a\u0648\u0646\u064a\u0648\n3\ufe0f\u20e3 \u063a\u064a\u0651\u0631 \u062c\u0645\u064a\u0639 \u0627\u0644\u0645\u0641\u0627\u062a\u064a\u062d \u0648\u0627\u0644\u0643\u0644\u0645\u0627\u062a \u0627\u0644\u0633\u0631\u064a\u0629\n4\ufe0f\u20e3 \u0644\u0627 \u062a\u0639\u0631\u0636 Langflow \u0639\u0644\u0649 \u0627\u0644\u0625\u0646\u062a\u0631\u0646\u062a \u0627\u0644\u0645\u0641\u062a\u0648\u062d\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udcca \u0633\u0644\u0633\u0644\u0629 \u0627\u0644\u0647\u062c\u0648\u0645 (Attack Chain):\n1. \u0627\u0644\u0628\u062d\u062b \u0639\u0646 \u0633\u064a\u0631\u0641\u0631\u0627\u062a Langflow \u0627\u0644\u0645\u0643\u0634\u0648\u0641\u0629\n2. \u0625\u0631\u0633\u0627\u0644 \u0643\u0648\u062f \u062e\u0628\u064a\u062b \u0644\u0644\u062a\u062d\u0642\u0642\n3. \u062a\u0646\u0641\u064a\u0630 \u0623\u0648\u0627\u0645\u0631 \u0627\u0644\u0646\u0638\u0627\u0645\n4. \u0633\u0631\u0642\u0629 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0640 Cloud\n5. \u0646\u0634\u0631 Malware \u0623\u0648 Cryptominer", "creation_timestamp": "2026-09-13T20:00:05.112473Z"} 2026-09-13T20:00:05.112473+00:00 https://vulnerability.circl.lu/sighting/2588c9b6-42ea-47ce-b259-3ff6edee3c5f/export 2026-09-17T12:00:03.551358+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "2588c9b6-42ea-47ce-b259-3ff6edee3c5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0778", "type": "seen", "source": "https://t.me/cissp/5722", "content": "Analytics\nTop 10 Most Used Vulns of the Month\n\nCVE-2022-1096 - Type Confusion in V8\nhttps://github.com/Maverick-cmd/Chrome-and-Edge-Version-Dumper\n\nCVE-2022-0847 - Dirty Pipe Vuln\n\nCVE-2022-0778 - OpenSSL Illegal x.509 certificate construction\n\nCVE-2022-0492 - Privilege escalation vuln causing container escape\nhttps://sysdig.com/blog/detecting-mitigating-cve-2022-0492-sysdig\n\nCVE-2022-22947 - Spring Cloud Gateway RCE\n\nCVE-2022-22963 - Spring Core RCE\n\nCVE-2022-25636 - net/netfilter/nf_dup_netdev.c in the Linux kernel <5.6.10 allows local users to gain privileges because of a heap out-of-bounds write\n\nCVE-2022-27254 - Vuln in Honda's Remote Keyless System\nhttps://github.com/nonamecoder/CVE-2022-27254\n\nCVE-2022-0609 - https://blog.google/threat-analysis-group/countering-threats-north-korea", "creation_timestamp": "2026-09-11T00:00:43.286813Z"} 2026-09-11T00:00:43.286813+00:00 https://vulnerability.circl.lu/sighting/b83bcecc-1823-4a2b-824a-8e433eee338a/export 2026-09-17T12:00:03.551463+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "b83bcecc-1823-4a2b-824a-8e433eee338a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0778", "type": "seen", "source": "https://t.me/cissp/5512", "content": "http://fumalwareanalysis.blogspot.com/p/malware-analysis-tutorials-reverse.html?m=1\n\nA new \"B1txor20\" Linux botnet malware has been discovered that spreads via the Log4J vulnerability and uses DNS tunnels for covert C2 communications.\nRead details: https://thehackernews.com/2022/03/new-b1txor20-linux-botnet-uses-dns.html\n\nA new infinite loop vulnerability (CVE-2022-0778) in OpenSSL could allow attackers to crash remote servers by passing a malformed certificate.\nRead details: https://thehackernews.com/2022/03/new-infinite-loop-bug-in-openssl-could.html\n\nFBI and CISA warn that Russian state-sponsored hackers are exploiting misconfigured multi-factor authentication (MFA) protocols and vulnerabilities in the Windows Print Spooler for cyberattacks.\nRead details: https://thehackernews.com/2022/03/fbi-cisa-warn-of-russian-hackers.html\n\nhttps://kb.cybermentordojo.com/knowledge-base/entry-to-cyber-blueprint/", "creation_timestamp": "2026-09-11T00:00:42.434034Z"} 2026-09-11T00:00:42.434034+00:00 https://vulnerability.circl.lu/sighting/076859ce-26ff-4425-b86f-c680d151852c/export 2026-09-17T12:00:03.551569+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "076859ce-26ff-4425-b86f-c680d151852c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0778", "type": "seen", "source": "https://t.me/cissp/5512", "content": "http://fumalwareanalysis.blogspot.com/p/malware-analysis-tutorials-reverse.html?m=1\n\nA new \"B1txor20\" Linux botnet malware has been discovered that spreads via the Log4J vulnerability and uses DNS tunnels for covert C2 communications.\nRead details: https://thehackernews.com/2022/03/new-b1txor20-linux-botnet-uses-dns.html\n\nA new infinite loop vulnerability (CVE-2022-0778) in OpenSSL could allow attackers to crash remote servers by passing a malformed certificate.\nRead details: https://thehackernews.com/2022/03/new-infinite-loop-bug-in-openssl-could.html\n\nFBI and CISA warn that Russian state-sponsored hackers are exploiting misconfigured multi-factor authentication (MFA) protocols and vulnerabilities in the Windows Print Spooler for cyberattacks.\nRead details: https://thehackernews.com/2022/03/fbi-cisa-warn-of-russian-hackers.html\n\nhttps://kb.cybermentordojo.com/knowledge-base/entry-to-cyber-blueprint/", "creation_timestamp": "2026-09-10T11:00:04.413847Z"} 2026-09-10T11:00:04.413847+00:00