[CVE-2026-0770]

July 23, 2026

• CVE-2026-0770 — Langflow RCE added to CISA KEV under active exploitation. The critical (CVSS 9.8) unauthenticated RCE in the popular AI-agent-building framework abuses the exec_globals parameter in the validation endpoint; CISA ordered federal agencies to patch on an urgent timeline (BleepingComputer). · AI & Model Security

in "Every Frontier Model Tried to Cheat": UK Safety Institute Puts Numbers Behind the OpenAI–Hugging Face Incident