Do Son 
TL;DR
CISA added four flaws to its KEV catalog on July 21, 2026. The list covers critical WordPress and Langflow bugs plus an older DD-WRT router flaw. CISA lists only bugs with confirmed active exploitation.
Why it matters
The CISA KEV catalog tracks flaws that attackers already abuse. So each entry demands fast action. Under Binding Operational Directive 26-04, federal agencies must patch listed bugs quickly. CISA also urges private teams to treat the list as a priority. Notably, attackers often chain lower-severity bugs into full compromise. The WordPress pair shows that risk clearly. However, CISA did not name the actors or share exploit details.
How the attacks work
WordPress: CVE-2026-63030 and CVE-2026-60137
Two WordPress Core bugs chain together. CVE-2026-60137 is a SQL injection in the author__not_in query parameter. A plugin or theme must pass untrusted input for it to fire. CVE-2026-63030 is a REST API route confusion issue. Together, they can drive SQL injection and then remote code execution. The SQL injection alone rates medium severity. The chain with route confusion pushes the impact much higher.
Langflow: CVE-2026-0770
CVE-2026-0770 is an unauthenticated remote code execution flaw. It sits in the validate endpoint’s exec_globals handling. An attacker can run code with root rights. The bug carries a critical CVSS 9.8 score. Langflow builds AI workflows, so exposed servers make an easy target.
DD-WRT: CVE-2021-27137
This older bug is a stack buffer overflow in UPnP handling. An unauthenticated attacker can trigger it with a crafted M-SEARCH request. Its CVSS score sits at 8.1. However, UPnP stays off by default and listens only on internal interfaces.
Affected versions
WordPress 6.8.x, 6.9.x, and 7.0.x need the latest fixes. Langflow users should update to the patched release. DD-WRT builds before 45724 carry the router flaw. Sites on older branches should upgrade without delay. Auto-updates cover many installs, but not all.
Patch and mitigation
First, update WordPress to 6.8.6, 6.9.5, or 7.0.2 now. Next, patch Langflow and limit access to its endpoints. Also, disable UPnP on DD-WRT unless you need it. Finally, scan your estate for exposed Langflow servers and old router firmware. With these bugs in the CISA KEV catalog, quick patching is the safest move.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
