CISA Adds DD-WRT, Langflow, and WordPress Flaws to Its Known Exploited Vulnerabilities Catalog
The U.S. Cybersecurity Agency includes critical vulnerabilities in its Known Exploited Vulnerabilities list.
1CISA's New Additions
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added critical vulnerabilities in DD-WRT, Langflow, and WordPress to its Known Exploited Vulnerabilities (KEV) catalog. These flaws pose potential risks for cyberattacks.
2DD-WRT Buffer Overflow Vulnerability
CVE-2021-27137 causes a buffer overflow vulnerability in DD-WRT's UPnP functionality. Attackers can exploit this flaw by sending specially crafted M-SEARCH requests to execute arbitrary code on the system.
3Langflow's Critical Flaw
CVE-2026-0770 allows remote code execution in Langflow. This vulnerability arises from the application improperly loading functionality from untrusted sources, enabling attackers to gain root access.
4Severe WordPress Vulnerabilities
Two critical vulnerabilities tracked as CVE-2026-63030 and CVE-2026-60137 in WordPress Core enable remote code execution and SQL injection. These flaws affect WordPress versions 6.9.x and 7.0.x.
5Mandatory Updates
WordPress released version 7.0.2 to patch these security flaws and enforced automatic updates. This is a critical step to secure millions of websites.
6Urgent Cybersecurity Measures
CISA has instructed federal agencies to fix these vulnerabilities by 2026. Private organizations are also advised to review the catalog and update their systems to mitigate risks.