CVE-2026-9198

Vendor

Apache Software Foundation, N-able

Product

AI / LLM tooling

CVSS

9.8

CISA KEV

listed

Exposure class

AI infrastructure, Web platform, Remote access

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 68
   KEV NVD 17 Jul 2026

   Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow…

   Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.

   KEV CVSS 9.8 Fix available CVE-2026-9198
2. 53
   CISA advisory CISA 4 Aug 2026

   CISA Adds Three Known Exploited Vulnerabilities to Catalog

   CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-9198 IBM Langflow Code Injection Vulnerability CVE-2026-18556 N-able N-central…

   Exploited CVE-2026-9198CVE-2026-18556CVE-2026-34486 Apache Software Foundation N-able
3. 16
   Research Insikt Group 8 Sep 2026

   August 2026 CVE Landscape

   In August 2026, Insikt Group® identified 73 high-impact vulnerabilities that should be prioritized for remediation, 43 of which had a Very Critical Recorded Future Risk Score. This represents a 14% decrease from last month.

   CVE-2025-62593CVE-2026-72898CVE-2026-9198+57 more