# CISA Adds DD-WRT, Langflow, and WordPress Flaws to Its Known Exploited Vulnerabilities Catalog The U.S. Cybersecurity Agency includes critical vulnerabilities in its Known Exploited Vulnerabilities list. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-07-22 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/3f53bfb4-e8a1-490e-9163-cf8829c4044e ## CISA's New Additions The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added critical vulnerabilities in DD-WRT, Langflow, and WordPress to its Known Exploited Vulnerabilities (KEV) catalog. These flaws pose potential risks for cyberattacks. ## DD-WRT Buffer Overflow Vulnerability CVE-2021-27137 causes a buffer overflow vulnerability in DD-WRT's UPnP functionality. Attackers can exploit this flaw by sending specially crafted M-SEARCH requests to execute arbitrary code on the system. ## Langflow's Critical Flaw CVE-2026-0770 allows remote code execution in Langflow. This vulnerability arises from the application improperly loading functionality from untrusted sources, enabling attackers to gain root access. ## Severe WordPress Vulnerabilities Two critical vulnerabilities tracked as CVE-2026-63030 and CVE-2026-60137 in WordPress Core enable remote code execution and SQL injection. These flaws affect WordPress versions 6.9.x and 7.0.x. ## Mandatory Updates WordPress released version 7.0.2 to patch these security flaws and enforced automatic updates. This is a critical step to secure millions of websites. ## Urgent Cybersecurity Measures CISA has instructed federal agencies to fix these vulnerabilities by 2026. Private organizations are also advised to review the catalog and update their systems to mitigate risks. ## Sources covering this story - https://securityaffairs.com/195782/security/u-s-cisa-adds-dd-wrt-langflow-and-wordpress-flaws-to-its-known-exploited-vulnerabilities-catalog.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._