{"metadata": {"vulnerability": "cve-2026-9198", "count": 103, "kinds": {"milestone": 5, "sighting": 72, "kev": 11, "other": 15}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0251", "record": "NCSC-2026-0251", "field": "document.tracking.generator.date"}, {"timestamp": "2026-05-21T15:40:11.465Z", "date_only": false, "value": "2026-05-21T15:40:11.465Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-9198", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-17T00:00:00Z", "date_only": false, "value": "2026-07-17T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-9198", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-17T00:00:00Z", "date_only": false, "value": "2026-07-17T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-9198", "record": "FKIE_CVE-2026-9198", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-17T17:36:11.246Z", "date_only": false, "value": "2026-07-17T17:36:11.246Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-9198", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-17T18:17:17Z", "date_only": false, "value": "2026-07-17T18:17:17Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5WM9-VGMG-CJV6", "record": "GHSA-5WM9-VGMG-CJV6", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-07-17T18:17:17.340Z", "date_only": false, "value": "2026-07-17T18:17:17.340", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-9198", "record": "FKIE_CVE-2026-9198", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-17T18:18:04.827Z", "date_only": false, "value": "2026-07-17T18:18:04.827080Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mquedxsgce2v", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "808fb007-8ee6-4f07-8273-94c3173b7c51", "content": "CVE-2026-9198 - langflow oss\nIBM Langflow's default settings allow unauthorized users to run code on the system, posing a significant risk. This issue affects versions 1.0.0 through 1.10.0 of the software.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#langflowoss #ibm #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mquedxsgce2v"}, {"timestamp": "2026-07-17T18:31:27Z", "date_only": false, "value": "2026-07-17T18:31:27Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5WM9-VGMG-CJV6", "record": "GHSA-5WM9-VGMG-CJV6", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-18T20:00:14.650Z", "date_only": false, "value": "2026-07-18T20:00:14.650205Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqx2jkspbj2f", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "0006300f-50ba-4924-b5cc-fc5aa77d25d0", "content": "\ud83d\udd34 CVE-2026-9198 - Critical (9.8)\n\nIBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_logi...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-9198/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqx2jkspbj2f"}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": true, "value": "2026-07-20", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2026-31205", "record": "CNVD-2026-31205", "field": "submitTime"}, {"timestamp": "2026-07-21T09:42:05.796Z", "date_only": false, "value": "2026-07-21T09:42:05.796837Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0251", "record": "NCSC-2026-0251", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-07-21T09:42:05.796Z", "date_only": false, "value": "2026-07-21T09:42:05.796837Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0251", "record": "NCSC-2026-0251", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-21T09:42:05.796Z", "date_only": false, "value": "2026-07-21T09:42:05.796837Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0251", "record": "NCSC-2026-0251", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-07-22T16:00:04.151Z", "date_only": false, "value": "2026-07-22T16:00:04.151980Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/bdufstecru/3338", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "1688a9c7-6b17-4d80-a8cd-08782f4a2acd", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 /api/v1/validate/code, /api/v1/auto_login \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0438\u0437\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0418\u0418-\u0430\u0433\u0435\u043d\u0442\u043e\u0432 IBM Langflow OSS \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-10244\nCVE-2026-9198\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\n\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.10.1:\nhttps://www.ibm.com/support/pages/node/7278927", "url": "https://t.me/bdufstecru/3338"}, {"timestamp": "2026-07-22T16:15:17.908Z", "date_only": false, "value": "2026-07-22T16:15:17.908629Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/langflow-poc-pubblico-per-lo-sfruttamento-della-cve-2026-9198", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "11892f19-3508-4bfb-8cdc-a3ce9349745d", "url": "https://www.acn.gov.it/portale/w/langflow-poc-pubblico-per-lo-sfruttamento-della-cve-2026-9198"}, {"timestamp": "2026-07-22T17:00:04.905Z", "date_only": false, "value": "2026-07-22T17:00:04.905389Z", "kind": "sighting", "label": "Seen", "source": "Telegram/wu7ZwWUDhyI14H4kQ3LWs1KWN75IcQ-iWlf3DfK8jhFVpKA", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "014a3ad2-3aa0-4175-a0b0-06ab08ed58e3"}, {"timestamp": "2026-07-23T01:00:05.594Z", "date_only": false, "value": "2026-07-23T01:00:05.594485Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/wu7ZwWUDhyI14H4kQ3LWs1KWN75IcQ-iWlf3DfK8jhFVpKA", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "17db7fe0-9697-479d-8e24-438693cff5e9", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-23T01:00:40.967Z", "date_only": false, "value": "2026-07-23T01:00:40.967777Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/langflow-poc-pubblico-per-lo-sfruttamento-della-cve-2026-9198", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "c0e92762-c7a3-4ae8-a262-1cdda95e5bae", "content": "Disponibile un Proof of Concept (PoC) per la CVE-2026-9198 - gi\u00e0 sanata dal vendor - presente in Langflow OSS, nota piattaforma open source integrata nelle soluzioni enterprise di IBM, per la progettazione visuale di workflow basati su Intelligenza Artificiale. Tale vulnerabilit\u00e0, qualora sfruttata, potrebbe consentire ad un utente malintenzionato remoto di eseguire codice arbitrario sui sistemi interessati.", "url": "https://www.acn.gov.it/portale/w/langflow-poc-pubblico-per-lo-sfruttamento-della-cve-2026-9198"}, {"timestamp": "2026-07-23T05:00:05.777Z", "date_only": false, "value": "2026-07-23T05:00:05.777932Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94477", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "1f0c3662-8bd6-462b-876e-a4e6adec723c", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-9198_exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xdak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 11:15:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94477"}, {"timestamp": "2026-07-24T00:00:09.647Z", "date_only": false, "value": "2026-07-24T00:00:09.647986Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94477", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "b52bb32d-0366-4fe1-b580-dedf6d8e8478", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-9198_exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xdak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 11:15:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94477", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-24T11:00:03.753Z", "date_only": false, "value": "2026-07-24T11:00:03.753493Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94943", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "dd58638f-44b8-491c-8abf-b797ab928f3a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-9198\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ywh-jfellus\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-24 09:42:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nProof of Concept for CVE-2026-9198 - IBM Langflow Unauthenticated RCE via Auto-Login Bypass\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94943"}, {"timestamp": "2026-07-24T15:00:03.986Z", "date_only": false, "value": "2026-07-24T15:00:03.986468Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/rA_p99UjCZMfj7lKKpB-QLOB_ZbKAJGY8XrtkZJhqRLC2rg", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "d85b1386-739d-4733-a637-d115d8f854ff", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-24T18:00:04.231Z", "date_only": false, "value": "2026-07-24T18:00:04.231114Z", "kind": "sighting", "label": "Seen", "source": "Telegram/M-3cLQvPgI-q_MEcWYT-wWAA2JFIhIDN85UPqM1dZ7X-wCw", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "6f1ec301-ad47-4865-8c6f-be5443b1429e"}, {"timestamp": "2026-07-24T22:00:04.563Z", "date_only": false, "value": "2026-07-24T22:00:04.563856Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/95016", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "d617e0e0-e3f3-4ba4-859e-7c72522f9aec", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-9198\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xgh057r3c0n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-24 20:59:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nIBM Langflow Unauthenticated RCE via Auto-Login Bypass\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/95016"}, {"timestamp": "2026-07-25T00:00:09.352Z", "date_only": false, "value": "2026-07-25T00:00:09.352559Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/95016", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "92643fa3-1193-48ba-9fb7-df506afe12c0", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-9198\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xgh057r3c0n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-24 20:59:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nIBM Langflow Unauthenticated RCE via Auto-Login Bypass\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/95016", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-25T00:00:10.949Z", "date_only": false, "value": "2026-07-25T00:00:10.949086Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94943", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "f114dae0-ff86-4763-becf-8f71d06ba6d2", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-9198\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ywh-jfellus\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-24 09:42:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nProof of Concept for CVE-2026-9198 - IBM Langflow Unauthenticated RCE via Auto-Login Bypass\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94943", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-25T04:00:03.905Z", "date_only": false, "value": "2026-07-25T04:00:03.905820Z", "kind": "sighting", "label": "Seen", "source": "Telegram/MD-MwBd_W8uwTqsEvI7HPalRa1bGoxdlVd6D-EmkL4FhnPg", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "0242d8dc-6c6b-4b1d-bb29-fbacc6b4cfe5"}, {"timestamp": "2026-07-26T00:00:46.828Z", "date_only": false, "value": "2026-07-26T00:00:46.828082Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/MD-MwBd_W8uwTqsEvI7HPalRa1bGoxdlVd6D-EmkL4FhnPg", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "504fa5f8-4a36-42b8-b575-3237b1e8ca6d", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-26T11:07:06.757Z", "date_only": false, "value": "2026-07-26T11:07:06.757666Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrkahmpsvr2l", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "535ac666-b23a-43e5-9179-8a14c6b872c7", "content": "\ud83d\udccc CVE-2026-9198 - IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with... https://www.cyberhub.blog/cves/CVE-2026-9198", "url": "https://bsky.app/profile/cyberhub.blog/post/3mrkahmpsvr2l"}, {"timestamp": "2026-07-28T06:00:05.666Z", "date_only": false, "value": "2026-07-28T06:00:05.666601Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-9198.yaml", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "e9a5fc6d-cff6-4635-8d34-484d717c4933", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-9198.yaml"}, {"timestamp": "2026-07-28T10:00:04.790Z", "date_only": false, "value": "2026-07-28T10:00:04.790078Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/95481", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "bb1ac43a-0794-4274-b0a1-3bfd27537302", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-9198\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a samael0x4\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 07:52:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nIBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution [RCE]\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/95481"}, {"timestamp": "2026-07-29T00:00:39.091Z", "date_only": false, "value": "2026-07-29T00:00:39.091782Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/95481", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "4eed411f-07e5-40f4-9621-b74f8f5741d6", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-9198\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a samael0x4\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 07:52:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nIBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution [RCE]\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/95481", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-04T00:00:00Z", "date_only": false, "value": "2026-08-04T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-9198", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "e2b79e9e-4751-479e-a927-81545fcc8314", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-04T00:00:00Z", "date_only": true, "value": "2026-08-04", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-9198", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-08-04T00:00:00Z", "date_only": true, "value": "2026-08-04", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-9198", "field": "evidence.0.details.date_added", "uuid": "e2b79e9e-4751-479e-a927-81545fcc8314", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-04T00:00:00Z", "date_only": false, "value": "2026-08-04T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-9198", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "e2b79e9e-4751-479e-a927-81545fcc8314", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-04T00:00:00Z", "date_only": false, "value": "2026-08-04T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-9198", "field": "status.status_updated_at", "uuid": "e2b79e9e-4751-479e-a927-81545fcc8314", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-04T00:00:00Z", "date_only": false, "value": "2026-08-04T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-9198", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-08-04T16:45:52Z", "date_only": false, "value": "2026-08-04T16:45:52+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2026-9198", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "29f8096f-284c-410c-80f0-587d602e903c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-04T16:45:52Z", "date_only": false, "value": "2026-08-04T16:45:52+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2026-9198", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "29f8096f-284c-410c-80f0-587d602e903c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-04T16:45:52Z", "date_only": false, "value": "2026-08-04T16:45:52+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2026-9198", "field": "status.status_updated_at", "uuid": "29f8096f-284c-410c-80f0-587d602e903c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-04T16:45:52.078Z", "date_only": false, "value": "2026-08-04T16:45:52.078Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2026-9198", "field": "evidence.0.details.added_date", "uuid": "29f8096f-284c-410c-80f0-587d602e903c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-04T17:17:46.716Z", "date_only": false, "value": "2026-08-04T17:17:46.716727Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3msbjeotkgx2n", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "0c7bb0f4-3826-423d-8993-9bc2591ee47d", "content": "\ud83d\uded1 CVE-2026-9198\nIBM Langflow\nCVSS 9.8 / EPSS 2% / KEV \u2705\nTL;DR: IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login\u2026\nhttps://cvesentinel.com/report/CVE-2026-9198?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3msbjeotkgx2n"}, {"timestamp": "2026-08-04T18:00:01Z", "date_only": false, "value": "2026-08-04T18:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-9198", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "e2b79e9e-4751-479e-a927-81545fcc8314", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-04T18:00:01Z", "date_only": false, "value": "2026-08-04T18:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2026-9198", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "29f8096f-284c-410c-80f0-587d602e903c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-04T18:00:01.856Z", "date_only": false, "value": "2026-08-04T18:00:01.856788Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e2b79e9e-4751-479e-a927-81545fcc8314", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "61bab228-c91b-4187-9c33-6985f0944e5d", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e2b79e9e-4751-479e-a927-81545fcc8314", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-04T18:00:26.336Z", "date_only": false, "value": "2026-08-04T18:00:26.336123Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/29f8096f-284c-410c-80f0-587d602e903c", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "ca50af20-4415-473d-8158-cecb1a481d51", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/29f8096f-284c-410c-80f0-587d602e903c", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-04T18:22:35.166Z", "date_only": false, "value": "2026-08-04T18:22:35.166317Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3msbmylvl7s27", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "6f9d2859-6180-4c3d-bbca-be1e28a24e62", "content": "CVE-2026-9198 \u00b7 trending #8\n\nCurrently trending CVE - Hype Score: 3 - IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (exec... https://cvemon.intruder.io/cves/CVE-2026-9198", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3msbmylvl7s27"}, {"timestamp": "2026-08-04T19:21:33.859Z", "date_only": false, "value": "2026-08-04T19:21:33.859571Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3msbqbznk2s2s", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "03a1969e-3859-4d12-bc1c-6271b4300802", "content": "\ud83d\udd34 EXPLOITED\n\nLangflow, the popular AI workflow builder, has a critical flaw (CVE-2026-9198): its auto-login endpoint hands any stranger an admin token, then a second endpoint runs their code.\n\nCISA says it's exploited now. Update past 1.10.0 and disable auto-login.", "url": "https://bsky.app/profile/suriq.io/post/3msbqbznk2s2s"}, {"timestamp": "2026-08-04T20:15:03.580Z", "date_only": false, "value": "2026-08-04T20:15:03.580093Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/ibm-security-advisory-av26-770", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "55a6524c-f56b-4841-b149-9a5128898e32", "url": "https://cyber.gc.ca/en/alerts-advisories/ibm-security-advisory-av26-770"}, {"timestamp": "2026-08-04T21:30:24Z", "date_only": false, "value": "2026-08-04T21:30:24Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5WM9-VGMG-CJV6", "record": "GHSA-5WM9-VGMG-CJV6", "field": "modified"}, {"timestamp": "2026-08-04T23:28:30.287Z", "date_only": false, "value": "2026-08-04T23:28:30.287268Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3msc63m3egi26", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "0057e506-e8e2-4b9d-b01d-6f525943b579", "content": "\ud83d\udea8 CISA KEV ALERT: CVE-2026-9198 identifies a critical unauthenticated code injection flaw in IBM Langflow allowing full RCE on default deployments. Active exploitation confirmed. Get the execution mechanics, CrowdStrike CQL detection, and compensating controls now: https://thecybermind.co/fi0v", "url": "https://bsky.app/profile/thecybermind.co/post/3msc63m3egi26"}, {"timestamp": "2026-08-05T02:59:38.040Z", "date_only": false, "value": "2026-08-05T02:59:38.040007Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mscjv5grby2e", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "033c7950-e37b-4372-b8eb-b9a90e8d64e6", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u60273\u4ef6\u3092\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 \n\nCISA Adds Three Known Exploited Vulnerabilities to Catalog  #CISA (Aug 4)\n\nCVE-2026-9198 IBM Langflow \u30b3\u30fc\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\nCVE-2026-18556 N-able N-central\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\uff08\u4ee3\u66ff\u30d1\u30b9\u307e\u305f\u306f\u30c1\u30e3\u30cd\u30eb\u306e\u4f7f\u7528\uff09\u306e\u8106\u5f31\u6027\nCVE-2026-34486 Apache Tomcat\u306b\u304a\u3051\u308b\u6a5f\u5bc6\u30c7\u30fc\u30bf\u306e\u6697\u53f7\u5316\u306e\u6b20\u843d\u306e\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mscjv5grby2e"}, {"timestamp": "2026-08-05T03:56:04.369Z", "date_only": false, "value": "2026-08-05T03:56:04.369Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-9198", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-05T09:48:38.831Z", "date_only": false, "value": "2026-08-05T09:48:38.831302Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3msdaqjb7kk2c", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "45a93507-48cf-4b23-8d6a-15f968d38508", "content": "CISA\u3001\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305fLangflow\u3001N-central\u3001Tomcat\u306e\u8106\u5f31\u6027\u3092\u8b66\u544a\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81(CISA)\u306f\u706b\u66dc\u65e5\u3001IBM Langflow OSS\u3001N-able N-central\u3001Apache Tomcat\u306b\u5b58\u5728\u3059\u308b3\u4ef6\u306e\u8106\u5f31\u6027\u304c\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u306b\u3088\u3063\u3066\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3068\u8b66\u544a\u3057\u307e\u3057\u305f\u3002 CVE-2026-9198(CVSS\u30b9\u30b3\u30a29.8)\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308bLangf...", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3msdaqjb7kk2c"}, {"timestamp": "2026-08-05T10:24:17.144Z", "date_only": false, "value": "2026-08-05T10:24:17.144914Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3msdcqap3ks2p", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "e945e369-0f22-4e27-a017-bd9fa9cbd8d7", "content": "\ud83e\udd16 CISA added 3 actively exploited flaws to its KEV catalog, incl. CVE-2026-9198 (CVSS 9.8): unauthenticated RCE in Langflow, plus Tomcat and N-central bugs. Patch now.\nhttps://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomcat-and-n.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3msdcqap3ks2p"}, {"timestamp": "2026-08-05T13:00:35.544Z", "date_only": false, "value": "2026-08-05T13:00:35.544808Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomcat-and-n.html", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "b67c1fc8-bfae-44d9-a020-c7d805c58056", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on August 5, 2026, added three flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.\n\nThe list of vulnerabilities is as follows -\n\n\n  CVE-2026-9198 (CVSS score: 9.8) - A code injection vulnerability in Langflow that allows unauthenticated attackers to achieve full remote", "url": "https://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomcat-and-n.html"}, {"timestamp": "2026-08-05T15:34:24.635Z", "date_only": false, "value": "2026-08-05T15:34:24.635219Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2ky3rs2k", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "04059771-c3ea-497f-82ca-6518f8ef30eb", "content": "2/ \u26a0\ufe0f CISA just added Langflow's CVE-2026-9198 (CVSS 9.8) to its actively exploited list. Unauthenticated remote code execution. Patch to 1.10.1 now if you run it. No excuses on this one.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2ky3rs2k"}, {"timestamp": "2026-08-05T15:34:25.257Z", "date_only": false, "value": "2026-08-05T15:34:25.257818Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2lbz622k", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "84de2ca2-7718-49a7-a024-a31e389cdd72", "content": "2/ \u26a0\ufe0f CISA just added Langflow's CVE-2026-9198 (CVSS 9.8) to its actively exploited list. Unauthenticated remote code execution. Patch to 1.10.1 now if you run it. No excuses on this one.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2lbz622k"}, {"timestamp": "2026-08-05T15:34:25.722Z", "date_only": false, "value": "2026-08-05T15:34:25.722357Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2lc34k2k", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "083cef5a-700e-4187-a1e7-37615c07b599", "content": "2/ \u26a0\ufe0f CISA just added Langflow's CVE-2026-9198 (CVSS 9.8) to its actively exploited list. Unauthenticated remote code execution. Patch to 1.10.1 now if you run it. No excuses on this one.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2lc34k2k"}, {"timestamp": "2026-08-05T15:34:26.170Z", "date_only": false, "value": "2026-08-05T15:34:26.170943Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2lc43s2k", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "8e393fae-db30-4efe-b0a2-22d8887da8f6", "content": "2/ \u26a0\ufe0f CISA just added Langflow's CVE-2026-9198 (CVSS 9.8) to its actively exploited list. Unauthenticated remote code execution. Patch to 1.10.1 now if you run it. No excuses on this one.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2lc43s2k"}, {"timestamp": "2026-08-05T15:34:26.620Z", "date_only": false, "value": "2026-08-05T15:34:26.620896Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2lc62c2k", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "3b3c28ed-2422-4531-a8db-d46c1a9b9cbf", "content": "2/ \u26a0\ufe0f CISA just added Langflow's CVE-2026-9198 (CVSS 9.8) to its actively exploited list. Unauthenticated remote code execution. Patch to 1.10.1 now if you run it. No excuses on this one.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2lc62c2k"}, {"timestamp": "2026-08-05T15:34:27.058Z", "date_only": false, "value": "2026-08-05T15:34:27.058444Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2lc6zk2k", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "72660eee-b6b8-4dbb-ada5-dff878a8cde4", "content": "2/ \u26a0\ufe0f CISA just added Langflow's CVE-2026-9198 (CVSS 9.8) to its actively exploited list. Unauthenticated remote code execution. Patch to 1.10.1 now if you run it. No excuses on this one.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2lc6zk2k"}, {"timestamp": "2026-08-05T15:34:27.502Z", "date_only": false, "value": "2026-08-05T15:34:27.502538Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2lc7ys2k", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "dad385b4-b094-4cb6-9439-9ef2023b531e", "content": "2/ \u26a0\ufe0f CISA just added Langflow's CVE-2026-9198 (CVSS 9.8) to its actively exploited list. Unauthenticated remote code execution. Patch to 1.10.1 now if you run it. No excuses on this one.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2lc7ys2k"}, {"timestamp": "2026-08-05T15:34:27.974Z", "date_only": false, "value": "2026-08-05T15:34:27.974181Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2lc7yt2k", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "514a1128-c4d9-48c7-bbc0-1778d34aad05", "content": "2/ \u26a0\ufe0f CISA just added Langflow's CVE-2026-9198 (CVSS 9.8) to its actively exploited list. Unauthenticated remote code execution. Patch to 1.10.1 now if you run it. No excuses on this one.", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3msdu2lc7yt2k"}, {"timestamp": "2026-08-05T17:09:59.860Z", "date_only": false, "value": "2026-08-05T17:09:59.860372Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threadlinqs.bsky.social/post/3msdzfpjpup2q", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "e98a216e-1b76-4f53-b704-72ec6c6a6cc1", "content": "CVE-2026-9198 chains an auto-login JWT bypass with exec() RCE for unauthenticated Langflow takeover. https://intel.threadlinqs.com/threat/TL-2026-1893 #ThreatIntel #CVE_2026_9198 #CVE_2026_9103 #KeyHunter", "url": "https://bsky.app/profile/threadlinqs.bsky.social/post/3msdzfpjpup2q"}, {"timestamp": "2026-08-05T20:00:04.992Z", "date_only": false, "value": "2026-08-05T20:00:04.992201Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/96800", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "728e35d5-1cf6-48cf-b67e-4f79b6ecdded", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a PoC-CVE-2026-9198\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rmhowe425\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-05 18:47:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/96800", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-05T20:37:17.484Z", "date_only": false, "value": "2026-08-05T20:37:17.484848Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mseeyfddjh2b", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "54536238-af62-4495-a9e1-65ec9980d42c", "content": "\ud83e\udd16 CISA KEV adds 3 exploited flaws: CVE-2026-9198 (9.8) Langflow RCE; CVE-2026-18576 N-central admin hijack; CVE-2026-34486 (7.5) Tomcat. Patch in 3 days.\n\nhttps://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-langflow-n-central-apache-tomcat-flaws/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mseeyfddjh2b"}, {"timestamp": "2026-08-05T21:00:03.898Z", "date_only": false, "value": "2026-08-05T21:00:03.898783Z", "kind": "sighting", "label": "Seen", "source": "Telegram/aUMSckDy3JDEcbvb6stjgMvcGejlLC1WM-LQ3QMdynxorg", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "63698028-2007-4e41-af82-be5046dfc002"}, {"timestamp": "2026-08-06T00:00:09.063Z", "date_only": false, "value": "2026-08-06T00:00:09.063671Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/aUMSckDy3JDEcbvb6stjgMvcGejlLC1WM-LQ3QMdynxorg", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "6df63aa4-d92d-4a7f-96e6-56a80200688d", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-07T00:00:00Z", "date_only": true, "value": "2026-08-07", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-9198", "field": "evidence.0.details.due_date", "uuid": "e2b79e9e-4751-479e-a927-81545fcc8314", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-07T00:00:00Z", "date_only": true, "value": "2026-08-07", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2026-31205", "record": "CNVD-2026-31205", "field": "openTime"}, {"timestamp": "2026-08-07T08:15:45.464Z", "date_only": false, "value": "2026-08-07T08:15:45.464230Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3msi4ib2pnp2r", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "37a6fba1-630e-4647-bf15-435c2b2c80c8", "content": "\ud83d\udea8 CISA just added three more flaws to its KEV catalog. Your patch queue just got longer.\n\nCVE-2026-9198.\n\nhttps://www.yazoul.net/news/article/cisa-flags-langflow-rce-tomcat-and-n-central-flaws-as-actively-exploited/\n\nby Yazoul AI #CyberSecurity #Security", "url": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3msi4ib2pnp2r"}, {"timestamp": "2026-08-07T16:14:59.287Z", "date_only": false, "value": "2026-08-07T16:14:59.287504Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/csirts.com/post/3msix5c3wid2z", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "ac10be0d-ac45-4549-98a7-77fbd275e174", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-9198: IBM Langflow Code Injection Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-9198", "url": "https://bsky.app/profile/csirts.com/post/3msix5c3wid2z"}, {"timestamp": "2026-08-11T02:00:03.414Z", "date_only": false, "value": "2026-08-11T02:00:03.414361Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/97507", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "e1c724a4-83d5-43d7-93bc-842848ac7f72", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #\u5229\u7528\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-9198\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a CuteeCat\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-11 00:55:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-9198\u5229\u7528\u4ee3\u7801\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/97507", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-12T08:00:04.219Z", "date_only": false, "value": "2026-08-12T08:00:04.219044Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/PfEGiROgrNR5ykZ5BXHTDqc3pwoH93Egm5-xEiTSmFuTh6c", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "f5455ad0-6b7a-4620-bf4b-4923294d2240", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-12T08:03:05.322Z", "date_only": false, "value": "2026-08-12T08:03:05.322927Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/nuke86.rfeed.it/post/3msuo45tbro24", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "ea8929cf-6ea9-45d5-9836-cf2dbd8598af", "content": "\u2728 CVE-2026-9198: Langflow sotto attacco attivo, ecco perch\u00e9 aggiornare subito \nLeggi il blog: spcnet.it/cve-2026-919...", "url": "https://bsky.app/profile/nuke86.rfeed.it/post/3msuo45tbro24"}, {"timestamp": "2026-08-13T08:45:55.490Z", "date_only": false, "value": "2026-08-13T08:45:55.490200Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-034", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "a5b81011-c1ad-48ba-b96a-752655cb533d", "url": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-034"}, {"timestamp": "2026-08-17T19:10:55.374Z", "date_only": false, "value": "2026-08-17T19:10:55.374Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-9198", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-17T19:10:55.374Z", "date_only": false, "value": "2026-08-17T19:10:55.374Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / ibm", "record": "cve-2026-9198", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-20T21:00:04.920Z", "date_only": false, "value": "2026-08-20T21:00:04.920665Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/infosec_ita_notizie/3606", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "67ae7a5a-93b1-4b12-805d-f2cf9b415bf9", "content": "\u2728 CVE-2026-9198: Langflow sotto attacco attivo, ecco perch\u00e9 aggiornare subito\nvia, Spcnet.it\n\n\ud83d\udd17 Leggi di pi\u00f9: https://spcnet.it/cve-2026-9198-langflow-sotto-attacco-attivo-ecco-perche-aggiornare-subito/", "url": "https://t.me/infosec_ita_notizie/3606"}, {"timestamp": "2026-08-21T00:00:08.718Z", "date_only": false, "value": "2026-08-21T00:00:08.718219Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/infosec_ita_notizie/3606", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "317552fe-fc95-47e3-a3dd-4c8cb9bd03dd", "content": "\u2728 CVE-2026-9198: Langflow sotto attacco attivo, ecco perch\u00e9 aggiornare subito\nvia, Spcnet.it\n\n\ud83d\udd17 Leggi di pi\u00f9: https://spcnet.it/cve-2026-9198-langflow-sotto-attacco-attivo-ecco-perche-aggiornare-subito/", "url": "https://t.me/infosec_ita_notizie/3606", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-21T23:00:06.937Z", "date_only": false, "value": "2026-08-21T23:00:06.937380Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pphm_HackerNews/2453", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "de0ca343-e484-4383-903e-043c7038030a", "content": "\ud83d\udd34 CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited\n\nCISA, on August 5, 2026,\u00a0added\u00a0three flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.\nThe list of vulnerabilities is as follows:\n\nCVE-2026-9198\u00a0(CVSS score: 9.8) - A code injection vulnerability in Langflow that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.\n\nCVE-2026-34486\u00a0(CVS score: 7.5) - A missing encryption of sensitive data vulnerability in Apache Tomcat that allows a bypass of EncryptInterceptor, a cluster component that adds pre-shared key encryption to messages sent between cluster nodes.\n\nAlso added to the KEV catalog is CVE-2026-18556 (CVSS score: 8.2), an authentication bypass vulnerability in N-able N-central. It's worth noting that an incomplete fix for this issue prompted N-able to issue a fresh patch, which is tracked as CVE-2026-18577 (CVSS score: 8.2).", "url": "https://t.me/pphm_HackerNews/2453"}, {"timestamp": "2026-08-22T19:00:04.761Z", "date_only": false, "value": "2026-08-22T19:00:04.761608Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/99236", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "251d7c25-3af5-4a11-8081-ff285026cb62", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-9198\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a K3ysTr0K3R\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-22 16:05:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-9198 - IBM Langflow OSS Unauthenticated Remote Code Execution (RCE)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/99236", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-23T22:00:03.398Z", "date_only": false, "value": "2026-08-23T22:00:03.398262Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/99382", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "d77eec2f-5016-41d0-b1aa-3dc09b358ab1", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-9198_exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a chessalekin\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-23 18:32:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/99382", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-24T06:44:14.307Z", "date_only": false, "value": "2026-08-24T06:44:14.307999Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/langflow_unauth_rce_cve_2026_9198.rb", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "e27f3679-c426-4574-8a61-0666e055823b", "content": "{\"aliases\": [], \"arch\": \"python\", \"author\": [\"Richard Howe \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Langflow versions 1.10.0 and below are susceptible to\\n          unauthenticated remote code execution. By chaining\\n          /api/v1/auto_login with /api/v1/validate/code, a remote\\n          unauthenticated attacker can send crafted HTTP requests to execute\\n          arbitrary code.\", \"disclosure_date\": \"2026-07-17\", \"fullname\": \"exploit/multi/http/langflow_unauth_rce_cve_2026_9198\", \"is_install_path\": true, \"mod_time\": \"2026-08-21 14:02:04 +0000\", \"name\": \"Langflow AI auto_login RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/langflow_unauth_rce_cve_2026_9198.rb\", \"platform\": \"Python\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/langflow_unauth_rce_cve_2026_9198\", \"references\": [\"CVE-2026-9198\", \"URL-https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9198\"], \"rport\": 7860, \"session_types\": false, \"targets\": [\"Python payload\"], \"type\": \"exploit\"}", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/langflow_unauth_rce_cve_2026_9198.rb"}, {"timestamp": "2026-08-27T15:00:05.621Z", "date_only": false, "value": "2026-08-27T15:00:05.621019Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cve0day/496", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "29fc23cb-94e2-4eac-bcf8-bd723208e71a", "content": "CVE-2026-9198", "url": "https://t.me/cve0day/496", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-29T23:00:18.126Z", "date_only": false, "value": "2026-08-29T23:00:18.126260Z", "kind": "sighting", "label": "Seen", "source": "Telegram/mygM17KSjyX1ytBX-vC2bUSC6Qu_yw0MIzjWP6u1Kpz11D0", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "e3b9144c-1515-4f48-aee0-ad9a35f0a51f"}, {"timestamp": "2026-08-30T03:00:04.427Z", "date_only": false, "value": "2026-08-30T03:00:04.427090Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/100299", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "d701b936-2a39-4cea-8141-744eb8b21911", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a EXPLOIT-CVE-2026-9198\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a joaovicdev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-29 23:50:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/100299", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-31T00:00:03.289Z", "date_only": false, "value": "2026-08-31T00:00:03.289324Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/nik-kale.bsky.social/post/3mudlxwzy3p2m", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "002c20b8-3057-4195-a4df-b6bbd83d1ec6", "content": "CISA added CVE-2026-9198 to the KEV catalog. Langflow, CVSS 9.8, unauthenticated code injection to full remote code execution on default deployments. Fixed in 1.10.1. Federal remediation was due August 7.", "url": "https://bsky.app/profile/nik-kale.bsky.social/post/3mudlxwzy3p2m"}, {"timestamp": "2026-08-31T00:00:42.917Z", "date_only": false, "value": "2026-08-31T00:00:42.917108Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/mygM17KSjyX1ytBX-vC2bUSC6Qu_yw0MIzjWP6u1Kpz11D0", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "906dec4d-8735-4142-81ff-70817719de30", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-02T00:00:00Z", "date_only": false, "value": "2026-09-02T00:00:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://www.exploit-db.com/exploits/52675", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "5771f84c-dc2a-4a7d-a8de-70efb2fe3a34", "url": "https://www.exploit-db.com/exploits/52675", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-02T23:00:05.051Z", "date_only": false, "value": "2026-09-02T23:00:05.051560Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8572", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "51091bd4-0e82-4927-bba5-a77660c1ea93", "content": "\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (CVE-2026-0768) \u0432 Langflow, \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0418\u0418, \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0438 \u043a\u043b\u044e\u0447\u0435\u0439.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0446\u0435\u043d\u043a\u0443 \u0438 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0432\u0430\u043b\u0438\u0434\u0430\u0442\u043e\u0440\u0435 \u043a\u043e\u0434\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 Langflow.\n\nVulnCheck \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u043b\u043e\u0432\u0443\u0448\u043a\u0430\u0445 \u0434\u043b\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0432 \u0412\u0435\u043b\u0438\u043a\u043e\u0431\u0440\u0438\u0442\u0430\u043d\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0442\u0430\u043b\u0438 \u0446\u0435\u043b\u044c\u044e \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c 50 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0432\u0437\u043b\u043e\u043c\u0430 \u0437\u0430 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043e\u0431\u0449\u0435\u0435 \u0447\u0438\u0441\u043b\u043e \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u043b\u043e\u0441\u044c \u0434\u043e 360.\n\n\u041f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0443 \u0438 \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u0442 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u043b\u0438 \u043a\u043b\u044e\u0447\u0435\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0443\u043f\u0435\u0440\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0434\u043b\u044f \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 Langflow, \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 AWS \u0438 \u043a\u043b\u044e\u0447\u0435\u0439 API OpenAI.\n\nLangflow - \u044d\u0442\u043e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u00a0\u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c\u00a0\u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Python, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0418\u0418, \u0430\u0433\u0435\u043d\u0442\u043e\u0432, \u0447\u0430\u0442-\u0431\u043e\u0442\u043e\u0432 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0441 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e (RAG).\n\n\u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0432 \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435, \u0441\u043e\u0435\u0434\u0438\u043d\u044f\u044f \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u044f\u0437\u044b\u043a\u043e\u0432\u044b\u0445 \u043c\u043e\u0434\u0435\u043b\u0435\u0439, \u043f\u043e\u0434\u0441\u043a\u0430\u0437\u043e\u043a, \u0431\u0430\u0437 \u0434\u0430\u043d\u043d\u044b\u0445, API \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432.\n\nCVE-2026-0768 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432 \u044f\u043d\u0432\u0430\u0440\u0435 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 Langflow 1.4.2 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432.\n\n\u041a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 \u043a\u043e\u0434\u0430, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0438\u0437-\u0437\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0435\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0441\u0442\u0440\u043e\u043a\u0438 \u043f\u0435\u0440\u0435\u0434 \u0435\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 Python.\n\n\u0412 \u0440\u0430\u043c\u043a\u0430\u0445 Zero Day Initiative \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Trend Micro\u00a0\u0441\u043e\u043e\u0431\u0449\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0438\u0437-\u0437\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0435\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0441\u0442\u0440\u043e\u043a\u0438 \u043f\u0435\u0440\u0435\u0434 \u0435\u0451 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 Python.\n\nCVE-2026-0768 - \u043d\u0435 \u043f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443.\n\n\u0412 \u043c\u0430\u0440\u0442\u0435, \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0447\u0435\u0440\u0435\u0437 \u0441\u0443\u0442\u043a\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 CVE-2026-33017, \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 Python \u0438 \u0441\u0431\u043e\u0440\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u0444\u0430\u0439\u043b\u043e\u0432 .ENV \u0438 \u0431\u0430\u0437 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0417\u0430 \u044d\u0442\u0438\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u0438 \u0430\u0442\u0430\u043a\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c\u00a0CVE-2026-5027\u00a0\u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0438 CVE-2026-55255\u00a0\u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c \u0418\u0418 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043a\u0440\u0430\u0436\u0438 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u0430\u0442\u043e\u0432 \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u044d\u0442\u0430\u043f\u0430.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u00a0CVE-2026-0770\u00a0\u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0438 \u043f\u044b\u0442\u0430\u043b\u0438\u0441\u044c \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u044b \u0438 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432.\n\n\u041d\u0435\u0434\u0430\u0432\u043d\u043e CISA \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u043b\u0430 \u043e\u0431 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438\u00a0CVE-2026-9198\u00a0\u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u043c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u044b PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c Langflow \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, 1.11.6, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0432\u0441\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430.", "url": "https://t.me/true_secator/8572", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-04T22:15:30.105Z", "date_only": false, "value": "2026-09-04T22:15:30.105264Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mupyhmm3xk2b", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "5e802e1f-623c-4822-9be8-103d48e5d96d", "content": "CISA Adds Three Known Exploited Vulnerabilities to Catalog\nRelease Date August 04, 2026\n\nCVE-2026-9198 IBM Langflow Code Injection Vulnerability\nCVE-2026-18556 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability\nCVE-2026-34486 Apache Tomcat Missing Encryption o...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mupyhmm3xk2b"}, {"timestamp": "2026-09-04T22:18:31.945Z", "date_only": false, "value": "2026-09-04T22:18:31.945094Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mupymzro222b", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "71f6b152-72ad-4062-b88c-816bc4628fc9", "content": "\u300cLangflow\u300d\u300cTomcat\u300d\u306a\u3069\u8106\u5f31\u60273\u4ef6\u306e\u60aa\u7528\u306b\u6ce8\u610f\u559a\u8d77 - \u7c73\u5f53\u5c40\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001\u300cApache Tomcat\u300d\u306b\u95a2\u3059\u308b\u8106\u5f31\u6027\u3092\u306f\u3058\u3081\u3001\u60aa\u7528\u3055\u308c\u3066\u3044\u308b3\u4ef6\u306e\u65e2\u77e5\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u6ce8\u610f\u3092\u559a\u8d77\u3057\u305f\u3002\n\n\u73fe\u5730\u6642\u95932026\u5e748\u67084\u65e5\u3001\u300c\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\uff08KEV\uff09\u300d\u306b3\u4ef6\u306e\u8106\u5f31\u6027\u300cCVE-2026-9198\u300d\u300cCVE-2026-34486\u300d\u300cCVE-2026-18556\u300d\u3092\u8ffd\u52a0\u3057\u305f\u3002\u3044\u305a\u308c\u3082\u7c73\u884c\u653f\u6a5f\u95a2\u306e\u5bfe\u7b56\u671f\u9650\u306f\u540c\u67087\u65e5\u3068\u3057\u3066\u304a\u308a\u3001\u65e9\u6025\u306a\u5bfe\u5fdc\u3092\u6c42\u3081\u3066\u3044\u308b\u3002\n\n\u300cCVE-2026-9198\u300d\u306f\u3001AI\u30a2\u30d7\u30ea\u306e\u958b\u767a\u57fa\u76e4\u3067...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mupymzro222b"}, {"timestamp": "2026-09-05T00:24:36.618Z", "date_only": false, "value": "2026-09-05T00:24:36.618074Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3muq7ogo2522b", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "c4530217-5ec9-442a-a189-bc308932fe11", "content": "CISA\u306f\u3001Langflow RCE\u3001Tomcat\u3001\u304a\u3088\u3073N-central\u306e\u8106\u5f31\u6027\u304c\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3068\u8b66\u544a\u3057\u305f\u3002\n\n\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u30012026\u5e748\u67085\u65e5\u3001\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u8a3c\u62e0\u304c\u3042\u308b\u3068\u3057\u3066\u3001\u65e2\u77e5\u306e\u60aa\u7528\u8106\u5f31\u6027\uff08KEV \uff09\u30ab\u30bf\u30ed\u30b0\u306b3\u3064\u306e\u8106\u5f31\u6027\u3092\u8ffd\u52a0\u3057\u305f\u3002\n\n\u8106\u5f31\u6027\u306e\u4e00\u89a7\u306f\u4ee5\u4e0b\u306e\u3068\u304a\u308a\u3067\u3059\u3002\n\nCVE-2026-9198\uff08CVSS\u30b9\u30b3\u30a2\uff1a9.8\uff09 - Langflow\u306b\u304a\u3051\u308b\u30b3\u30fc\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u3002\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u653b\u6483\u8005\u304c\u3001\u30c7\u30d5\u30a9\u30eb\u30c8\u306eLangflow\u30c7\u30d7\u30ed\u30a4\u30e1\u30f3\u30c8\u4e0a\u3067\u5b8c\u5168\u306a\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u3092\u53ef\u80fd\u306b\u3059\u308b\u3002\uff082026\u5e74...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3muq7ogo2522b"}, {"timestamp": "2026-09-05T00:46:35.973Z", "date_only": false, "value": "2026-09-05T00:46:35.973333Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3muqavr4t6c2b", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "923fb006-7969-4cd2-bf36-1866c76a7b59", "content": "CISA\u304cLangflow\u3001N-central\u3001Tomcat\u306e\u8106\u5f31\u6027\u304c\u60aa\u7528\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3068\u8b66\u544a\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u706b\u66dc\u65e5\u3001\u653b\u6483\u8005\u304cIBM Langflow OSS\u3001N-able N-central\u3001\u304a\u3088\u3073Apache Tomcat\u306b\u5b58\u5728\u3059\u308b3\u3064\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u3066\u3044\u308b\u3068\u8b66\u544a\u3057\u305f\u3002\n\nCVE-2026-9198\uff08CVSS\u30b9\u30b3\u30a29.8\uff09 \u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308bLangflow OSS\u306e\u30d0\u30b0\u306f\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u653b\u6483\u8005\u304c2\u3064\u306eAPI\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u3092\u9023\u7d50\u3057\u3066\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u3092\u53ef\u80fd\u306b\u3059\u308b\u3082\u306e\u3067\u3059\u3002\n\n\u3053\u306e\u554f\u984c\u306f7\u670817\u65e5\u306bIBM\u304cLangfl...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3muqavr4t6c2b"}, {"timestamp": "2026-09-05T01:55:31.444Z", "date_only": false, "value": "2026-09-05T01:55:31.444717Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3muqeqzyys22b", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "775db167-0633-48bd-8fa1-84a0fad8aa1a", "content": "\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\u306b\u3001Langflow\u3001Apache Tomcat\u3001\u304a\u3088\u3073N-able N-central\u306e\u8106\u5f31\u6027\u3092\u8ffd\u52a0\u3057\u305f\u3002\n\n\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001 \u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u4ee5\u4e0b\u306e\u8106\u5f31\u6027\u3092\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\nCVE-2026-9198  \uff08CVSS\u30b9\u30b3\u30a29.8\uff09IBM Langflow\u30b3\u30fc\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\nCVE-2026-18556  \uff08CVSS\u30b9\u30b3\u30a28.2\uff09N-able N-central\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\uff08\u4ee3\u66ff\u30d1\u30b9\u307e\u305f...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3muqeqzyys22b"}, {"timestamp": "2026-10-07T12:35:36.754Z", "date_only": false, "value": "2026-10-07T12:35:36.754952Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxbxh34cvk2v", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "8f495d06-f400-4bc6-9a94-c3d1b296ab09", "content": "~Asec~\n36,971 CVEs disclosed; 100 entered CISA KEV, with exploitation targeting exposed management, APIs, AI and infrastructure.\n-\nIOCs: CVE-2026-50522, CVE-2026-76460, CVE-2026-9198\n-\n#CVE #ThreatIntel #Vulnerabilities", "url": "https://bsky.app/profile/cyfar.ca/post/3mxbxh34cvk2v"}, {"timestamp": "2026-10-12T02:00:11Z", "date_only": false, "value": "2026-10-12T02:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105007", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "26a57f58-f8cd-4f69-aef1-b024b306ef09", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a langflow-cve-2026-9198\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Riftweld\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-12 01:42:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nIndependent reconstruction, lab validation, and PoC for CVE-2026-9198, the Langflow unauthenticated RCE (fixed in 1.10.1)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105007", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-12T09:00:05Z", "date_only": false, "value": "2026-10-12T09:00:05.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/PI-hG2GEsw3MRUqc-1YXl8UPc43Q4_gyssqHOCf2stdhAV8", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "6defe2c4-72c0-4ebe-b576-9657ff5e401c"}, {"timestamp": "2026-10-24T20:10:00.137Z", "date_only": false, "value": "2026-10-24T20:10:00.137", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-9198", "record": "FKIE_CVE-2026-9198", "field": "lastModified"}], "metrics": {"as_of": "2026-10-28T20:56:27.309Z", "anchors": {"origin": {"timestamp": "2026-07-17T17:36:11.246Z", "date_only": false, "value": "2026-07-17T17:36:11.246Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-9198", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-07-17T17:36:11.246Z", "date_only": false, "value": "2026-07-17T17:36:11.246Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-9198", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-07-23T01:00:05.594Z", "date_only": false, "value": "2026-07-23T01:00:05.594485Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/wu7ZwWUDhyI14H4kQ3LWs1KWN75IcQ-iWlf3DfK8jhFVpKA", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "17db7fe0-9697-479d-8e24-438693cff5e9", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-08-04T00:00:00Z", "date_only": false, "value": "2026-08-04T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-9198", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "e2b79e9e-4751-479e-a927-81545fcc8314", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 1491828.754, "hours": 414.3968761111111, "days": 17.26653650462963, "min_seconds": 1491828.754, "max_seconds": 1578228.754, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-17T17:36:11.246Z", "date_only": false, "value": "2026-07-17T17:36:11.246Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-9198", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-08-04T00:00:00Z", "date_only": false, "value": "2026-08-04T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-9198", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "e2b79e9e-4751-479e-a927-81545fcc8314", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 1491828.754, "hours": 414.3968761111111, "days": 17.26653650462963, "min_seconds": 1491828.754, "max_seconds": 1578228.754, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-17T17:36:11.246Z", "date_only": false, "value": "2026-07-17T17:36:11.246Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-9198", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-08-04T00:00:00Z", "date_only": false, "value": "2026-08-04T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-9198", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "e2b79e9e-4751-479e-a927-81545fcc8314", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 458634.348, "hours": 127.39843, "days": 5.308267916666667, "min_seconds": 458634.348, "max_seconds": 458634.348, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-17T17:36:11.246Z", "date_only": false, "value": "2026-07-17T17:36:11.246Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-9198", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-23T01:00:05.594Z", "date_only": false, "value": "2026-07-23T01:00:05.594485Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/wu7ZwWUDhyI14H4kQ3LWs1KWN75IcQ-iWlf3DfK8jhFVpKA", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "17db7fe0-9697-479d-8e24-438693cff5e9", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 8911216.063665, "hours": 2475.3377954625003, "days": 103.13907481093752, "min_seconds": 8911216.063665, "max_seconds": 8911216.063665, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-17T17:36:11.246Z", "date_only": false, "value": "2026-07-17T17:36:11.246Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-9198", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-28T20:56:27.309Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 7419387.309665, "hours": 2060.940919351389, "days": 85.87253830630787, "min_seconds": 7332987.309665, "max_seconds": 7419387.309665, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-04T00:00:00Z", "date_only": false, "value": "2026-08-04T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-9198", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "e2b79e9e-4751-479e-a927-81545fcc8314", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-10-28T20:56:27.309Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 8452581.715665, "hours": 2347.9393654625, "days": 97.83080689427082, "min_seconds": 8452581.715665, "max_seconds": 8452581.715665, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-23T01:00:05.594Z", "date_only": false, "value": "2026-07-23T01:00:05.594485Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/wu7ZwWUDhyI14H4kQ3LWs1KWN75IcQ-iWlf3DfK8jhFVpKA", "record": "CVE-2026-9198", "field": "creation_timestamp", "uuid": "17db7fe0-9697-479d-8e24-438693cff5e9", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-28T20:56:27.309Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}