https://vulnerability.circl.lu/sightings/feed 2026-09-17T09:38:49.162951+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/74449144-b3f6-4553-a52a-70fba9a607ba/export 2026-09-17T09:38:49.174071+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "74449144-b3f6-4553-a52a-70fba9a607ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0768", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-0768.yaml", "content": "", "creation_timestamp": "2026-09-17T00:00:05.337471Z"} 2026-09-17T00:00:05.337471+00:00 https://vulnerability.circl.lu/sighting/276f51cc-f9d6-4576-b827-b0f26d25aefb/export 2026-09-17T09:38:49.176084+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "276f51cc-f9d6-4576-b827-b0f26d25aefb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0770", "type": "seen", "source": "https://bsky.app/profile/greynoise.infosec.exchange.ap.brid.gy/post/3mvniypzuabu2", "content": "Two remote code execution flaws that CISA lists as known exploited turned up this week inside ordinary commodity crawling.\n\nAdversaries attempted CVE-2025-3248 and CVE-2026-0770 in Langflow, the AI application platform, at 3,968 and 4,770 connection attempts [\u2026] \n\n[Original post on infosec.exchange]", "creation_timestamp": "2026-09-16T15:58:51.469307Z"} 2026-09-16T15:58:51.469307+00:00 https://vulnerability.circl.lu/sighting/e1d2bb68-40a0-4af6-a4ce-23854dcb113d/export 2026-09-17T09:38:49.176189+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e1d2bb68-40a0-4af6-a4ce-23854dcb113d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0770", "type": "seen", "source": "https://infosec.exchange/users/greynoise/statuses/117281541720935473", "content": "Two remote code execution flaws that CISA lists as known exploited turned up this week inside ordinary commodity crawling.\nAdversaries attempted CVE-2025-3248 and CVE-2026-0770 in Langflow, the AI application platform, at 3,968 and 4,770 connection attempts, both new to this brief series. The addresses behind them are the interesting part. Every one of them also carries a generic web crawling tag, roughly nine in ten collected environment files and enumerated WordPress installations, and about four in five requested repository configuration in the same window. Two hosting providers supply roughly 95% of those addresses, which means the source count measures how that traffic leaves those networks. A sweep of that shape reaches any exposed Langflow instance a general crawler touches.\nThe rest of the week concentrated the same way. Five of the ten highest-volume sources ran SSH enumeration and credential attacks from consumer broadband and mobile carrier networks, and four of them carried 36% of all alternative-port SSH crawling we observed. Two shared client fingerprints group those four across four separate networks, marking a common tool class. One address supplied more than half of all Remote Desktop crawling observed and three fifths of the credential attempts inside it.\nGreyNoise customers get the full weekly brief. Our public At The Edge one-page: https://www.greynoise.io/resources/at-the-edge-clear-091426", "creation_timestamp": "2026-09-16T15:58:27.086571Z"} 2026-09-16T15:58:27.086571+00:00 https://vulnerability.circl.lu/sighting/49500abf-2ca7-421b-8ab3-ec4b88d86530/export 2026-09-17T09:38:49.176275+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "49500abf-2ca7-421b-8ab3-ec4b88d86530", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0768", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-0768.yaml", "content": "", "creation_timestamp": "2026-09-16T00:00:05.348809Z"} 2026-09-16T00:00:05.348809+00:00 https://vulnerability.circl.lu/sighting/bdd98d6f-037e-42d2-986e-8aadad363631/export 2026-09-17T09:38:49.176346+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "bdd98d6f-037e-42d2-986e-8aadad363631", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0768", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-0768.yaml", "content": "", "creation_timestamp": "2026-09-15T09:00:06.996010Z"} 2026-09-15T09:00:06.996010+00:00 https://vulnerability.circl.lu/sighting/6e3a158b-e662-45b2-aff3-6ba47266d041/export 2026-09-17T09:38:49.176420+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6e3a158b-e662-45b2-aff3-6ba47266d041", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0770", "type": "published-proof-of-concept", "source": "https://t.me/CYPERMRED/132", "content": "\ud83d\udea8 CVE-2026-0770 | \u062b\u063a\u0631\u0629 \u062d\u0631\u062c\u0629 \u0641\u064a \u0645\u0646\u0635\u0629 Langflow\n\n\u26a0\ufe0f \u0627\u0644\u062e\u0637\u0648\u0631\u0629: 9.8/10 (\u062d\u0631\u062c\u0629 \u062c\u062f\u0627\u064b)\n\ud83d\udcc5 \u0627\u0644\u0627\u0643\u062a\u0634\u0627\u0641: \u064a\u0648\u0646\u064a\u0648 2026 | CISA \u0623\u0636\u0627\u0641\u062a\u0647\u0627: 21 \u064a\u0648\u0644\u064a\u0648 2026\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u2753 \u0645\u0627 \u0647\u064a Langflow\u061f\n\u0645\u0646\u0635\u0629 \u0645\u0641\u062a\u0648\u062d\u0629 \u0627\u0644\u0645\u0635\u062f\u0631 \u0644\u0628\u0646\u0627\u0621 AI Agents \u0648\u062e\u0637\u0648\u0637 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 (Workflows) \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 LLMs.\n\n\u2753 \u0645\u0627 \u0647\u064a \u0627\u0644\u062b\u063a\u0631\u0629\u061f\n\u0646\u0642\u0637\u0629 \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0627\u0644\u0643\u0648\u062f /api/v1/validate/code \u0643\u0627\u0646\u062a \u062a\u0633\u062a\u062e\u062f\u0645 exec() \u0628\u062f\u0644 compile() \u0641\u0642\u0637.\n\n\u0627\u0644\u0647\u0627\u0643\u0631 \u064a\u0631\u0633\u0644 \u0643\u0648\u062f Python \u0628\u0633\u064a\u0637 \u2014 \u0627\u0644\u0645\u0646\u0635\u0629 \"\u062a\u0641\u062d\u0635\u0647\" \u2014 \u0648\u0627\u0644\u0643\u0648\u062f \u064a\u0646\u0641\u0630 \u062a\u0644\u0642\u0627\u0626\u064a\u0627\u064b!\n\n\ud83d\udca1 \u0645\u062b\u0627\u0644 \u0628\u0633\u064a\u0637:\ndef pwn(x=import('os').system('id')):\n pass\n\n\u0647\u0630\u0627 \u0627\u0644\u0643\u0648\u062f \"\u0645\u0627 \u064a\u062a\u0645 \u0627\u0633\u062a\u062f\u0639\u0627\u0624\u0647\" \u2014 \u0628\u0633 \u062a\u0639\u0631\u064a\u0641\u0647 \u064a\u0646\u0641\u0630 \u0627\u0644\u0623\u0645\u0631 id \u0639\u0644\u0649 \u0627\u0644\u0633\u064a\u0631\u0641\u0631!\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udd34 \u0644\u0645\u0627\u0630\u0627 \u062e\u0637\u064a\u0631\u0629\u061f\n\u2022 \u0644\u0627 \u062a\u062d\u062a\u0627\u062c \u062a\u0633\u062c\u064a\u0644 \u062f\u062e\u0648\u0644 (Unauthenticated)\n\u2022 \u0637\u0644\u0628 POST \u0648\u0627\u062d\u062f \u0643\u0627\u0641\u064a\n\u2022 \u062a\u0646\u0641\u0630 \u0628\u0635\u0644\u0627\u062d\u064a\u0627\u062a root \u0641\u064a \u0627\u0644\u063a\u0627\u0644\u0628\n\u2022 \u062a\u0633\u0631\u0642: \u0645\u0641\u0627\u062a\u064a\u062d AWS\u060c \u0628\u064a\u0627\u0646\u0627\u062a Kubernetes\u060c \u0645\u062a\u063a\u064a\u0631\u0627\u062a \u0627\u0644\u0628\u064a\u0626\u0629\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udee1 \u0627\u0644\u062d\u0645\u0627\u064a\u0629:\n1\ufe0f\u20e3 \u062d\u062f\u0651\u062b Langflow \u0644\u0640 1.10.1 \u0641\u0648\u0631\u0627\u064b\n2\ufe0f\u20e3 \u0627\u0641\u062d\u0635 \u0627\u0644\u0633\u062c\u0644\u0627\u062a \u0644\u0640 /api/v1/validate/code \u0645\u0646\u0630 27 \u064a\u0648\u0646\u064a\u0648\n3\ufe0f\u20e3 \u063a\u064a\u0651\u0631 \u062c\u0645\u064a\u0639 \u0627\u0644\u0645\u0641\u0627\u062a\u064a\u062d \u0648\u0627\u0644\u0643\u0644\u0645\u0627\u062a \u0627\u0644\u0633\u0631\u064a\u0629\n4\ufe0f\u20e3 \u0644\u0627 \u062a\u0639\u0631\u0636 Langflow \u0639\u0644\u0649 \u0627\u0644\u0625\u0646\u062a\u0631\u0646\u062a \u0627\u0644\u0645\u0641\u062a\u0648\u062d\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udcca \u0633\u0644\u0633\u0644\u0629 \u0627\u0644\u0647\u062c\u0648\u0645 (Attack Chain):\n1. \u0627\u0644\u0628\u062d\u062b \u0639\u0646 \u0633\u064a\u0631\u0641\u0631\u0627\u062a Langflow \u0627\u0644\u0645\u0643\u0634\u0648\u0641\u0629\n2. \u0625\u0631\u0633\u0627\u0644 \u0643\u0648\u062f \u062e\u0628\u064a\u062b \u0644\u0644\u062a\u062d\u0642\u0642\n3. \u062a\u0646\u0641\u064a\u0630 \u0623\u0648\u0627\u0645\u0631 \u0627\u0644\u0646\u0638\u0627\u0645\n4. \u0633\u0631\u0642\u0629 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0640 Cloud\n5. \u0646\u0634\u0631 Malware \u0623\u0648 Cryptominer\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udd17 \u0627\u0644\u0645\u0635\u062f\u0631: resecurity.com\n\ud83d\udce4 \u0634\u0627\u0631\u0643 \u0645\u0639 \u0641\u0631\u064a\u0642 DevOps/Security \u0639\u0646\u062f\u0643\n\ud83d\udcac \u0647\u0644 \u062a\u0633\u062a\u062e\u062f\u0645 Langflow\u061f \u0627\u0643\u062a\u0628 \u0644\u0646\u0627 \ud83d\udc47\n\n#CVE2026_0770 #Langflow #RCE #Cybersecurity t.me/CYPERMRED", "creation_timestamp": "2026-09-14T00:00:11.216318Z"} 2026-09-14T00:00:11.216318+00:00 https://vulnerability.circl.lu/sighting/e7f1da9c-4722-4911-afd4-9634f1fdde2c/export 2026-09-17T09:38:49.176528+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e7f1da9c-4722-4911-afd4-9634f1fdde2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0770", "type": "published-proof-of-concept", "source": "https://t.me/CYPERMRED/133", "content": "\ud83d\udea8 CVE-2026-0770 | \u062b\u063a\u0631\u0629 \u062d\u0631\u062c\u0629 \u0641\u064a \u0645\u0646\u0635\u0629 Langflow\n\n\u26a0\ufe0f \u0627\u0644\u062e\u0637\u0648\u0631\u0629: 9.8/10 (\u062d\u0631\u062c\u0629 \u062c\u062f\u0627\u064b)\n\ud83d\udcc5 \u0627\u0644\u0627\u0643\u062a\u0634\u0627\u0641: \u064a\u0648\u0646\u064a\u0648 2026 | CISA \u0623\u0636\u0627\u0641\u062a\u0647\u0627: 21 \u064a\u0648\u0644\u064a\u0648 2026\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u2753 \u0645\u0627 \u0647\u064a Langflow\u061f\n\u0645\u0646\u0635\u0629 \u0645\u0641\u062a\u0648\u062d\u0629 \u0627\u0644\u0645\u0635\u062f\u0631 \u0644\u0628\u0646\u0627\u0621 AI Agents \u0648\u062e\u0637\u0648\u0637 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 (Workflows) \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 LLMs.\n\n\u2753 \u0645\u0627 \u0647\u064a \u0627\u0644\u062b\u063a\u0631\u0629\u061f\n\u0646\u0642\u0637\u0629 \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0627\u0644\u0643\u0648\u062f /api/v1/validate/code \u0643\u0627\u0646\u062a \u062a\u0633\u062a\u062e\u062f\u0645 exec() \u0628\u062f\u0644 compile() \u0641\u0642\u0637.\n\n\u0627\u0644\u0647\u0627\u0643\u0631 \u064a\u0631\u0633\u0644 \u0643\u0648\u062f Python \u0628\u0633\u064a\u0637 \u2014 \u0627\u0644\u0645\u0646\u0635\u0629 \"\u062a\u0641\u062d\u0635\u0647\" \u2014 \u0648\u0627\u0644\u0643\u0648\u062f \u064a\u0646\u0641\u0630 \u062a\u0644\u0642\u0627\u0626\u064a\u0627\u064b!\n\n\ud83d\udca1 \u0645\u062b\u0627\u0644 \u0628\u0633\u064a\u0637:\ndef pwn(x=import('os').system('id')):\n pass\n\n\u0647\u0630\u0627 \u0627\u0644\u0643\u0648\u062f \"\u0645\u0627 \u064a\u062a\u0645 \u0627\u0633\u062a\u062f\u0639\u0627\u0624\u0647\" \u2014 \u0628\u0633 \u062a\u0639\u0631\u064a\u0641\u0647 \u064a\u0646\u0641\u0630 \u0627\u0644\u0623\u0645\u0631 id \u0639\u0644\u0649 \u0627\u0644\u0633\u064a\u0631\u0641\u0631!\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udd34 \u0644\u0645\u0627\u0630\u0627 \u062e\u0637\u064a\u0631\u0629\u061f\n\u2022 \u0644\u0627 \u062a\u062d\u062a\u0627\u062c \u062a\u0633\u062c\u064a\u0644 \u062f\u062e\u0648\u0644 (Unauthenticated)\n\u2022 \u0637\u0644\u0628 POST \u0648\u0627\u062d\u062f \u0643\u0627\u0641\u064a\n\u2022 \u062a\u0646\u0641\u0630 \u0628\u0635\u0644\u0627\u062d\u064a\u0627\u062a root \u0641\u064a \u0627\u0644\u063a\u0627\u0644\u0628\n\u2022 \u062a\u0633\u0631\u0642: \u0645\u0641\u0627\u062a\u064a\u062d AWS\u060c \u0628\u064a\u0627\u0646\u0627\u062a Kubernetes\u060c \u0645\u062a\u063a\u064a\u0631\u0627\u062a \u0627\u0644\u0628\u064a\u0626\u0629\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udee1 \u0627\u0644\u062d\u0645\u0627\u064a\u0629:\n1\ufe0f\u20e3 \u062d\u062f\u0651\u062b Langflow \u0644\u0640 1.10.1 \u0641\u0648\u0631\u0627\u064b\n2\ufe0f\u20e3 \u0627\u0641\u062d\u0635 \u0627\u0644\u0633\u062c\u0644\u0627\u062a \u0644\u0640 /api/v1/validate/code \u0645\u0646\u0630 27 \u064a\u0648\u0646\u064a\u0648\n3\ufe0f\u20e3 \u063a\u064a\u0651\u0631 \u062c\u0645\u064a\u0639 \u0627\u0644\u0645\u0641\u0627\u062a\u064a\u062d \u0648\u0627\u0644\u0643\u0644\u0645\u0627\u062a \u0627\u0644\u0633\u0631\u064a\u0629\n4\ufe0f\u20e3 \u0644\u0627 \u062a\u0639\u0631\u0636 Langflow \u0639\u0644\u0649 \u0627\u0644\u0625\u0646\u062a\u0631\u0646\u062a \u0627\u0644\u0645\u0641\u062a\u0648\u062d\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udcca \u0633\u0644\u0633\u0644\u0629 \u0627\u0644\u0647\u062c\u0648\u0645 (Attack Chain):\n1. \u0627\u0644\u0628\u062d\u062b \u0639\u0646 \u0633\u064a\u0631\u0641\u0631\u0627\u062a Langflow \u0627\u0644\u0645\u0643\u0634\u0648\u0641\u0629\n2. \u0625\u0631\u0633\u0627\u0644 \u0643\u0648\u062f \u062e\u0628\u064a\u062b \u0644\u0644\u062a\u062d\u0642\u0642\n3. \u062a\u0646\u0641\u064a\u0630 \u0623\u0648\u0627\u0645\u0631 \u0627\u0644\u0646\u0638\u0627\u0645\n4. \u0633\u0631\u0642\u0629 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0640 Cloud\n5. \u0646\u0634\u0631 Malware \u0623\u0648 Cryptominer", "creation_timestamp": "2026-09-14T00:00:11.166321Z"} 2026-09-14T00:00:11.166321+00:00 https://vulnerability.circl.lu/sighting/31ef10a9-6783-4344-b9e2-704c51029397/export 2026-09-17T09:38:49.176617+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "31ef10a9-6783-4344-b9e2-704c51029397", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0770", "type": "published-proof-of-concept", "source": "https://t.me/CYPERMRED/132", "content": "\ud83d\udea8 CVE-2026-0770 | \u062b\u063a\u0631\u0629 \u062d\u0631\u062c\u0629 \u0641\u064a \u0645\u0646\u0635\u0629 Langflow\n\n\u26a0\ufe0f \u0627\u0644\u062e\u0637\u0648\u0631\u0629: 9.8/10 (\u062d\u0631\u062c\u0629 \u062c\u062f\u0627\u064b)\n\ud83d\udcc5 \u0627\u0644\u0627\u0643\u062a\u0634\u0627\u0641: \u064a\u0648\u0646\u064a\u0648 2026 | CISA \u0623\u0636\u0627\u0641\u062a\u0647\u0627: 21 \u064a\u0648\u0644\u064a\u0648 2026\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u2753 \u0645\u0627 \u0647\u064a Langflow\u061f\n\u0645\u0646\u0635\u0629 \u0645\u0641\u062a\u0648\u062d\u0629 \u0627\u0644\u0645\u0635\u062f\u0631 \u0644\u0628\u0646\u0627\u0621 AI Agents \u0648\u062e\u0637\u0648\u0637 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 (Workflows) \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 LLMs.\n\n\u2753 \u0645\u0627 \u0647\u064a \u0627\u0644\u062b\u063a\u0631\u0629\u061f\n\u0646\u0642\u0637\u0629 \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0627\u0644\u0643\u0648\u062f /api/v1/validate/code \u0643\u0627\u0646\u062a \u062a\u0633\u062a\u062e\u062f\u0645 exec() \u0628\u062f\u0644 compile() \u0641\u0642\u0637.\n\n\u0627\u0644\u0647\u0627\u0643\u0631 \u064a\u0631\u0633\u0644 \u0643\u0648\u062f Python \u0628\u0633\u064a\u0637 \u2014 \u0627\u0644\u0645\u0646\u0635\u0629 \"\u062a\u0641\u062d\u0635\u0647\" \u2014 \u0648\u0627\u0644\u0643\u0648\u062f \u064a\u0646\u0641\u0630 \u062a\u0644\u0642\u0627\u0626\u064a\u0627\u064b!\n\n\ud83d\udca1 \u0645\u062b\u0627\u0644 \u0628\u0633\u064a\u0637:\ndef pwn(x=import('os').system('id')):\n pass\n\n\u0647\u0630\u0627 \u0627\u0644\u0643\u0648\u062f \"\u0645\u0627 \u064a\u062a\u0645 \u0627\u0633\u062a\u062f\u0639\u0627\u0624\u0647\" \u2014 \u0628\u0633 \u062a\u0639\u0631\u064a\u0641\u0647 \u064a\u0646\u0641\u0630 \u0627\u0644\u0623\u0645\u0631 id \u0639\u0644\u0649 \u0627\u0644\u0633\u064a\u0631\u0641\u0631!\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udd34 \u0644\u0645\u0627\u0630\u0627 \u062e\u0637\u064a\u0631\u0629\u061f\n\u2022 \u0644\u0627 \u062a\u062d\u062a\u0627\u062c \u062a\u0633\u062c\u064a\u0644 \u062f\u062e\u0648\u0644 (Unauthenticated)\n\u2022 \u0637\u0644\u0628 POST \u0648\u0627\u062d\u062f \u0643\u0627\u0641\u064a\n\u2022 \u062a\u0646\u0641\u0630 \u0628\u0635\u0644\u0627\u062d\u064a\u0627\u062a root \u0641\u064a \u0627\u0644\u063a\u0627\u0644\u0628\n\u2022 \u062a\u0633\u0631\u0642: \u0645\u0641\u0627\u062a\u064a\u062d AWS\u060c \u0628\u064a\u0627\u0646\u0627\u062a Kubernetes\u060c \u0645\u062a\u063a\u064a\u0631\u0627\u062a \u0627\u0644\u0628\u064a\u0626\u0629\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udee1 \u0627\u0644\u062d\u0645\u0627\u064a\u0629:\n1\ufe0f\u20e3 \u062d\u062f\u0651\u062b Langflow \u0644\u0640 1.10.1 \u0641\u0648\u0631\u0627\u064b\n2\ufe0f\u20e3 \u0627\u0641\u062d\u0635 \u0627\u0644\u0633\u062c\u0644\u0627\u062a \u0644\u0640 /api/v1/validate/code \u0645\u0646\u0630 27 \u064a\u0648\u0646\u064a\u0648\n3\ufe0f\u20e3 \u063a\u064a\u0651\u0631 \u062c\u0645\u064a\u0639 \u0627\u0644\u0645\u0641\u0627\u062a\u064a\u062d \u0648\u0627\u0644\u0643\u0644\u0645\u0627\u062a \u0627\u0644\u0633\u0631\u064a\u0629\n4\ufe0f\u20e3 \u0644\u0627 \u062a\u0639\u0631\u0636 Langflow \u0639\u0644\u0649 \u0627\u0644\u0625\u0646\u062a\u0631\u0646\u062a \u0627\u0644\u0645\u0641\u062a\u0648\u062d\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udcca \u0633\u0644\u0633\u0644\u0629 \u0627\u0644\u0647\u062c\u0648\u0645 (Attack Chain):\n1. \u0627\u0644\u0628\u062d\u062b \u0639\u0646 \u0633\u064a\u0631\u0641\u0631\u0627\u062a Langflow \u0627\u0644\u0645\u0643\u0634\u0648\u0641\u0629\n2. \u0625\u0631\u0633\u0627\u0644 \u0643\u0648\u062f \u062e\u0628\u064a\u062b \u0644\u0644\u062a\u062d\u0642\u0642\n3. \u062a\u0646\u0641\u064a\u0630 \u0623\u0648\u0627\u0645\u0631 \u0627\u0644\u0646\u0638\u0627\u0645\n4. \u0633\u0631\u0642\u0629 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0640 Cloud\n5. \u0646\u0634\u0631 Malware \u0623\u0648 Cryptominer\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udd17 \u0627\u0644\u0645\u0635\u062f\u0631: resecurity.com\n\ud83d\udce4 \u0634\u0627\u0631\u0643 \u0645\u0639 \u0641\u0631\u064a\u0642 DevOps/Security \u0639\u0646\u062f\u0643\n\ud83d\udcac \u0647\u0644 \u062a\u0633\u062a\u062e\u062f\u0645 Langflow\u061f \u0627\u0643\u062a\u0628 \u0644\u0646\u0627 \ud83d\udc47\n\n#CVE2026_0770 #Langflow #RCE #Cybersecurity t.me/CYPERMRED", "creation_timestamp": "2026-09-13T20:00:05.151414Z"} 2026-09-13T20:00:05.151414+00:00 https://vulnerability.circl.lu/sighting/f4ef3acf-3a25-445e-bbb2-4946812355d6/export 2026-09-17T09:38:49.176701+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f4ef3acf-3a25-445e-bbb2-4946812355d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0770", "type": "published-proof-of-concept", "source": "https://t.me/CYPERMRED/133", "content": "\ud83d\udea8 CVE-2026-0770 | \u062b\u063a\u0631\u0629 \u062d\u0631\u062c\u0629 \u0641\u064a \u0645\u0646\u0635\u0629 Langflow\n\n\u26a0\ufe0f \u0627\u0644\u062e\u0637\u0648\u0631\u0629: 9.8/10 (\u062d\u0631\u062c\u0629 \u062c\u062f\u0627\u064b)\n\ud83d\udcc5 \u0627\u0644\u0627\u0643\u062a\u0634\u0627\u0641: \u064a\u0648\u0646\u064a\u0648 2026 | CISA \u0623\u0636\u0627\u0641\u062a\u0647\u0627: 21 \u064a\u0648\u0644\u064a\u0648 2026\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u2753 \u0645\u0627 \u0647\u064a Langflow\u061f\n\u0645\u0646\u0635\u0629 \u0645\u0641\u062a\u0648\u062d\u0629 \u0627\u0644\u0645\u0635\u062f\u0631 \u0644\u0628\u0646\u0627\u0621 AI Agents \u0648\u062e\u0637\u0648\u0637 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 (Workflows) \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 LLMs.\n\n\u2753 \u0645\u0627 \u0647\u064a \u0627\u0644\u062b\u063a\u0631\u0629\u061f\n\u0646\u0642\u0637\u0629 \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0627\u0644\u0643\u0648\u062f /api/v1/validate/code \u0643\u0627\u0646\u062a \u062a\u0633\u062a\u062e\u062f\u0645 exec() \u0628\u062f\u0644 compile() \u0641\u0642\u0637.\n\n\u0627\u0644\u0647\u0627\u0643\u0631 \u064a\u0631\u0633\u0644 \u0643\u0648\u062f Python \u0628\u0633\u064a\u0637 \u2014 \u0627\u0644\u0645\u0646\u0635\u0629 \"\u062a\u0641\u062d\u0635\u0647\" \u2014 \u0648\u0627\u0644\u0643\u0648\u062f \u064a\u0646\u0641\u0630 \u062a\u0644\u0642\u0627\u0626\u064a\u0627\u064b!\n\n\ud83d\udca1 \u0645\u062b\u0627\u0644 \u0628\u0633\u064a\u0637:\ndef pwn(x=import('os').system('id')):\n pass\n\n\u0647\u0630\u0627 \u0627\u0644\u0643\u0648\u062f \"\u0645\u0627 \u064a\u062a\u0645 \u0627\u0633\u062a\u062f\u0639\u0627\u0624\u0647\" \u2014 \u0628\u0633 \u062a\u0639\u0631\u064a\u0641\u0647 \u064a\u0646\u0641\u0630 \u0627\u0644\u0623\u0645\u0631 id \u0639\u0644\u0649 \u0627\u0644\u0633\u064a\u0631\u0641\u0631!\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udd34 \u0644\u0645\u0627\u0630\u0627 \u062e\u0637\u064a\u0631\u0629\u061f\n\u2022 \u0644\u0627 \u062a\u062d\u062a\u0627\u062c \u062a\u0633\u062c\u064a\u0644 \u062f\u062e\u0648\u0644 (Unauthenticated)\n\u2022 \u0637\u0644\u0628 POST \u0648\u0627\u062d\u062f \u0643\u0627\u0641\u064a\n\u2022 \u062a\u0646\u0641\u0630 \u0628\u0635\u0644\u0627\u062d\u064a\u0627\u062a root \u0641\u064a \u0627\u0644\u063a\u0627\u0644\u0628\n\u2022 \u062a\u0633\u0631\u0642: \u0645\u0641\u0627\u062a\u064a\u062d AWS\u060c \u0628\u064a\u0627\u0646\u0627\u062a Kubernetes\u060c \u0645\u062a\u063a\u064a\u0631\u0627\u062a \u0627\u0644\u0628\u064a\u0626\u0629\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udee1 \u0627\u0644\u062d\u0645\u0627\u064a\u0629:\n1\ufe0f\u20e3 \u062d\u062f\u0651\u062b Langflow \u0644\u0640 1.10.1 \u0641\u0648\u0631\u0627\u064b\n2\ufe0f\u20e3 \u0627\u0641\u062d\u0635 \u0627\u0644\u0633\u062c\u0644\u0627\u062a \u0644\u0640 /api/v1/validate/code \u0645\u0646\u0630 27 \u064a\u0648\u0646\u064a\u0648\n3\ufe0f\u20e3 \u063a\u064a\u0651\u0631 \u062c\u0645\u064a\u0639 \u0627\u0644\u0645\u0641\u0627\u062a\u064a\u062d \u0648\u0627\u0644\u0643\u0644\u0645\u0627\u062a \u0627\u0644\u0633\u0631\u064a\u0629\n4\ufe0f\u20e3 \u0644\u0627 \u062a\u0639\u0631\u0636 Langflow \u0639\u0644\u0649 \u0627\u0644\u0625\u0646\u062a\u0631\u0646\u062a \u0627\u0644\u0645\u0641\u062a\u0648\u062d\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\ud83d\udcca \u0633\u0644\u0633\u0644\u0629 \u0627\u0644\u0647\u062c\u0648\u0645 (Attack Chain):\n1. \u0627\u0644\u0628\u062d\u062b \u0639\u0646 \u0633\u064a\u0631\u0641\u0631\u0627\u062a Langflow \u0627\u0644\u0645\u0643\u0634\u0648\u0641\u0629\n2. \u0625\u0631\u0633\u0627\u0644 \u0643\u0648\u062f \u062e\u0628\u064a\u062b \u0644\u0644\u062a\u062d\u0642\u0642\n3. \u062a\u0646\u0641\u064a\u0630 \u0623\u0648\u0627\u0645\u0631 \u0627\u0644\u0646\u0638\u0627\u0645\n4. \u0633\u0631\u0642\u0629 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0640 Cloud\n5. \u0646\u0634\u0631 Malware \u0623\u0648 Cryptominer", "creation_timestamp": "2026-09-13T20:00:05.112473Z"} 2026-09-13T20:00:05.112473+00:00 https://vulnerability.circl.lu/sighting/0c16d07d-a0fe-4d0e-8209-ce500f2b0e60/export 2026-09-17T09:38:49.176785+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0c16d07d-a0fe-4d0e-8209-ce500f2b0e60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0702", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-0702.yaml", "content": "", "creation_timestamp": "2026-09-13T00:00:05.294542Z"} 2026-09-13T00:00:05.294542+00:00