What you need to know today.
Critical vulnerabilities disclosed in Langflow, Juniper Junos OS, and Adobe ColdFusion, with Langflow added to CISA's KEV catalog.
A critical vulnerability in Langflow AI, CVE-2025-34291, has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. This chained vulnerability, affecting versions up to 1.6.9, allows for account takeover and remote code execution due to an overly permissive CORS configuration. Exploitation has been observed in the wild, highlighting the urgent need for patching. As The Hacker News reported, this flaw poses a significant risk to organizations using Langflow for AI development and deployment.
Juniper Networks has disclosed a significant number of vulnerabilities across its Junos OS and Junos OS Evolved platforms, with 25 flaws detailed in recent advisories. Among these, several critical vulnerabilities, including stack-based buffer overflows (CVE-2026-101982, CVE-2026-101990) and an improper authentication flaw in the J-Web interface (CVE-2026-101954), could lead to root code execution or denial of service. As reported by Vypr Intelligence, these vulnerabilities present a substantial attack surface for network infrastructure.
Adobe ColdFusion is facing a wave of 25 critical vulnerabilities, including code injection (CVE-2026-106624) and server-side request forgery (SSRF) flaws (CVE-2026-106622). These vulnerabilities could allow attackers to execute arbitrary code or escalate privileges within the affected systems. The scope of the SSRF vulnerability is noted as changed, potentially increasing its impact. Vypr Intelligence highlighted the severity of these issues, emphasizing the need for prompt patching by ColdFusion users.
Microsoft has addressed multiple vulnerabilities in its October Patch Tuesday, including critical flaws in Azure SQL Database (CVE-2026-69502) and Microsoft Partner Center (CVE-2026-96207). The Azure SQL Database vulnerability is an SSRF flaw that could lead to privilege escalation, while the Partner Center vulnerability allows for unauthorized privilege elevation over a network due to improper certificate validation. As detailed in Cisco Talos Intelligence, these issues underscore the ongoing security challenges within cloud and partner management platforms.
Several critical vulnerabilities have been identified in WordPress plugins and themes, including code injection in The Grid (CVE-2026-94169), PHP object injection in Sunshine Photo Cart (CVE-2026-104730), and deserialization of untrusted data in itthinx Affiliates (CVE-2026-108291). Additionally, the AGE-GATE plugin is vulnerable to remote code execution (CVE-2026-104800) due to missing security checks. These flaws highlight the persistent risks associated with third-party code in WordPress environments.