ctrlINT What the industry said about every indicator, with the quote

CVE-2026-5027Vulnerability

Reported by 3 independent sources · first reported by Recorded Future · last reported

Last reported 23 days ago

What the reports say

3 reports, newest first · the exact sentence from each

  1. “…e a command injection flaw in LiteLLM (CVE-2026-42271) that leads to host takeover and API credential theft, and two Langflow flaws (CVE-2026-5027 and CVE-2025-3248) that let attackers write files to the host or run code remotely.”

    Help Net SecurityNews
    The vulnerabilities AI finds are the ones attackers want

  2. “CVE-2026-5027 (Langflow): Path traversal file write in the POST /api/v2/files upload handler, allowing remote threat actors to drop unauthorized files (e.g., cron jobs, Secure Shell (SSH) keys) onto the host.”

    Google Threat IntelligenceVendor
    Vulnerability Discovery and Exploitation Trends in the AI Era

  3. “CVE-2026-5027”

    Recorded FutureVendor
    June 2026 CVE Landscape

Indicators reported together

named in the same reports

Also named with it: CVE-2026-42271, CVE-2026-1731, CVE-2025-3248, CVE-2026-25089, CVE-2026-39808, CVE-2026-11645, CVE-2026-28318, CVE-2026-20230, CVE-2026-35616, CVE-2026-33825, CVE-2025-55182, CVE-2026-21509, CVE-2025-8088, CVE-2025-6218, CVE-2026-35273, CVE-2021-27137, CVE-2026-46817, CVE-2026-48907, CVE-2026-12569, CVE-2022-27925

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2026-5027 here?
No account needed. We do not store your IP address.