Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

A critical vulnerability in Langflow’s code validation mechanism allows unauthenticated attackers to execute arbitrary Python code on exposed systems. Tracked as CVE-2025-3248, the vulnerability resides in a publicly accessible API endpoint and affects all Langflow versions prior to 1.3.0. Active exploitation has been confirmed, with attackers using the vulnerability to deploy malware and onboard compromised systems into botnet infrastructure.

On January 20, 2026, Oracle patched a maximum‑severity vulnerability in its Fusion Middleware suite affecting Oracle HTTP Server and the WebLogic Server Proxy Plug‑in, tracked as CVE‑2026‑21962. An unauthenticated remote threat actor can exploit this flaw to gain unauthorized creation, deletion, or modification access to critical data. The issue stems from improper handling of incoming requests by the WebLogic Server Proxy Plug‑ins for Apache HTTP Server and Microsoft IIS.

Seemplicity’s Year in Review is a product feature that provides each customer with a year-end view of how risk and exposure moved through their own environment. This post walks through the metrics included in the latest experience and what they help teams reflect on as they refine their exposure management processes.

On January 21, 2026, Cisco released fixes for a high-severity vulnerability impacting Cisco Unified Communications products that is under active exploitation, tracked as CVE-2026-20045. The flaw arises from improper input validation of user-supplied data in HTTP requests to the web-based management interface of affected devices.

In January 2026, the GNU telnetd service from GNU InetUtils was found to be vulnerable to authentication-bypass by Simon Josefsson. Tracked as CVE-2026-24061, this flaw allows an attacker to establish a Telnet session without providing valid credentials, granting unauthorized access to the target system. The vulnerability exists all the way up to version 2.7-2 of the GNU telnetd service and, as indicated by Simon, looks like it was taken right out of the 90s.