{"uuid": "4e0c8794-f2c3-44c4-a59d-b588342de245", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0768", "type": "seen", "source": "https://t.me/pphm_HackerNews/2946", "content": "\ud83d\udd34 Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity\n\nThreat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck.\n\nThe vulnerabilities in question are listed below:\n\nCVE-2026-0768 (CVSS score: 9.8) - A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of the root user.\n\nCVE-2026-66066 aka KindaRails2Shell (CVSS score: 9.5) - A vulnerability that could allow an unauthenticated attacker to read arbitrary files from the server, leak Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens, ultimately leading to remote code execution.", "creation_timestamp": "2026-09-01T14:00:05.804303Z"}