Langflow RCE and Widespread Unpatched Critical Flaws Define the Week

OS command injection in Langflow's MCP stdio transport allows an attacker who can reach the MCP server configuration endpoint (POST/PATCH /api/v2/mcp/servers/{server_name}) or add an MCP Tools component to a flow to execute arbitrary operating-system commands on the Langflow host, running with the privileges of the Langflow process user. The vulnerability affects Langflow before 1.10.3, langflow-base before 0.10.3, and lfx before 1.10.3, and is reachable without any account on an exposed instance left in its default LANGFLOW_AUTO_LOGIN=true configuration because GET /api/v1/auto_login issues a token without credentials; when AUTO_LOGIN is disabled, any authenticated non-admin user is sufficient (CVSS vector PR:L), so no administrative role is required. The command fires automatically as soon as Langflow tries to connect to the configured server (listing servers, loading tools, or running a flow), and the resulting execution is not confined to the Langflow process security context per the S:C scope metric. No public exploit code was identified at time of analysis, and vendor-released fixes are available in Langflow 1.10.3, langflow-base 0.10.3, and lfx 1.10.3.

Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 lets any attacker who can reach the service execute arbitrary operating system commands on the underlying host. Rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw requires no credentials, no user interaction, and no non-default configuration, so a default Langflow deployment exposed beyond localhost is directly exploitable. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); IBM has published a vendor advisory with a fix, and practical risk is concentrated in self-hosted developer instances that are bound to reachable interfaces rather than being restricted to localhost or placed behind authentication and firewalling.

Unauthenticated remote attackers with IP reachability to an affected Cisco NX-OS device can achieve arbitrary code execution with root privileges - or force a process crash and device reload - by sending crafted packets to the VXLAN Operation, Administration, and Maintenance (NGOAM) feature. The flaw is a stack-based buffer overflow (CWE-121) triggered by insufficient validation of IP traffic, and it is fully unauthenticated and requires no user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N), yielding a 9.8 base score. Exploitation is gated by configuration: NGOAM is not part of a default NX-OS base image and must be explicitly enabled, so only VXLAN deployments that have turned the feature on and that expose an IP interface to the attacker are exposed; no public exploit code or confirmed active exploitation was identified at time of analysis, but the high EPSS-relevant severity and pre-auth RCE impact warrant priority patching on any NGOAM-enabled fabric.

Unauthenticated remote OS command injection in the login.xgi CGI endpoint of Iskratel Innbox GPON ONT devices lets any attacker who can reach the device's web management interface run arbitrary operating-system commands with root privileges by supplying shell metacharacters through the CLI parameter. Rated CVSS 9.3 (CVSS 4.0) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the flaw requires no authentication, no user interaction, and no non-default configuration, giving a full compromise of the device's confidentiality, integrity, and availability. Publicly available exploit code exists in the form of a GitHub proof-of-concept that lands a root shell, so exploitation is straightforward for anyone with network reachability; no CISA KEV entry or confirmed in-the-wild exploitation was present in the available data, and the practical limiting factor is exposure - devices whose management plane is confined to the ISP access network or an isolated LAN are protected by segmentation rather than by any authentication control.

Unauthenticated remote code execution in the Anton Extensions WordPress plugin (versions ≤1.2.2) allows attackers to upload arbitrary PHP files to attacker-chosen paths, because the plugin omits capability checks, nonce verification, and file-type validation in its file upload handler. Publicly available exploit code exists according to WPScan, and exploitation requires only that the plugin be installed and active on a reachable WordPress site. The CVSS score of 9.8 reflects critical severity with no authentication required.

Missing authorization checks in the MultiversX 'multisig-improved' reference smart contract (mx-multisig-and-modules) allow an account holding the Proposer role to unilaterally move funds, draining 100% of a deployed contract's EGLD/ESDT balance in as few as two transactions with zero board signatures. The flaw is a CWE-306 missing-authentication issue in the fund-moving execution path; exploitation requires the attacker to already hold the Proposer role on a specific vulnerable deployment (assessed as PR:L, authenticated), not fully anonymous access, and publicly available exploit code exists, though there is no confirmed active exploitation (no CISA KEV) and EPSS is only 0.15% (3rd percentile). Deployments built from the affected commit are fully exposed once a Proposer-role account is compromised or malicious.

Authentication bypass in the Mindstien Quick Login WordPress plugin through version 1.0 allows unauthenticated remote attackers to obtain an administrator session on any affected site where the plugin is active and configured with an administrator account. The flaw (CWE-287) stems from the plugin failing to validate a request-supplied value against the visitor's own session before authenticating them, yielding a CVSS 3.1 base score of 9.8. Publicly available exploit code exists, and while the vulnerability is not confirmed as actively exploited (CISA KEV), the low attack complexity and lack of required authentication make immediate remediation critical.

Unauthenticated attackers can update and delete arbitrary WordPress options through the AI Content Generator Marketing plugin (versions through 1.0.0), a capability that typically enables full site takeover by, for example, flipping the default new-user role to administrator and enabling open registration. The plugin's AJAX handlers perform neither a nonce check nor a capability check, and because the CVSS vector is AV:N/AC:L/PR:N/UI:N with C/I/A all High, no authentication, user interaction, or non-default configuration is required - only that the plugin be installed and active and its endpoints reachable. Publicly available exploit code exists (ratings from WPScan), making opportunistic mass scanning realistic; there is no CISA KEV confirmation of active exploitation and no EPSS score was supplied, so this should be treated as high-severity, readily exploitable, but not yet confirmed as exploited in the wild. All available signals point to genuinely high risk.