Executive Summary
CISA added exploited Langflow origin validation flaw CVE-2025-34291 (CVSS 9.4) and a Trend Micro Apex One flaw to KEV.
What Happened
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Langflow and Trend Micro Apex One to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities in question are listed below - CVE-2025-34291 (CVSS score: 9.4) - An origin validation error vulnerability in Langflow that could
Affected Products
- Langflow
- Trend Micro Apex One
Vulnerability / Attack Technique
Exploited vulnerabilities including AI workflow builder
Technical Mechanism
Origin validation error.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Langflow continues to appear in KEV.
Recommended Controls
- Update Langflow
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/05/cisa-adds-exploited-langflow-and-trend.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.