NewsThe Hacker News
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Linked advisories
More on Authenticated
Other advisories
- HighCVE-2026-62251Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app
- Not ratedCVE-2026-77622Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder in github.com/bishopfox/sliver
- HighCVE-2026-84318Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE in github.com/0xJacky/Nginx-UI
- HighCVE-2026-84316Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI
- HighCVE-2026-84317Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI
- HighCVE-2026-84319Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI
- CriticalCVE-2026-107806Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite in github.com/0xJacky/Nginx-UI
- HighCVE-2026-107805Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage in github.com/0xJacky/Nginx-UI
Other news entries
- ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPsNewsDark Reading
- Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG ProcessingNewsThe Hacker News
- Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed ModulesNewsThe Hacker News
- Cisco Warns of Exploited Secure Email Gateway VulnerabilityNewsSecurityWeek
- Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active ExploitationNewsThe Hacker News
- Cisco patches new Secure Email Gateway zero-day exploited in attacksNewsBleepingComputer
- Zero-Days Lurk in Microsoft's Overgrown October Patch TuesdayNewsDark Reading
- Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPNNewsSecurityWeek
Source: https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html
ID