CISA Urges Immediate Patching of Exploited ColdFusion, Langflow, Joomla Flaws

Two newly disclosed critical vulnerabilities in Adobe ColdFusion and Langflow join two Joomla extension flaws in CISA's Known Exploited Vulnerabilities catalog, with federal agencies given until July 10 to patch. The post CISA Urges Immediate Patching of Exploited ColdFusion, Langflow, Joomla Flaws appeared first on SecurityWeek .

According to CISA and multiple security reports, four actively exploited vulnerabilities in Adobe ColdFusion, Langflow, and two Joomla page builders (SP Page Builder and Page Builder CK) have been added to the Known Exploited Vulnerabilities catalog, with federal agencies ordered to patch by July 10.[1][2][3] The Langflow flaw (CVE-2026-55255) is an authorization bypass/IDOR issue that lets an authenticated user execute flows belonging to other tenants by manipulating a flow identifier, while the Joomla and ColdFusion bugs enable unauthenticated arbitrary file upload and path traversal leading to remote code execution on web servers.[1][2][3][5] From a RealGround perspective, Langflow is part of the AI tooling stack used to orchestrate models, prompts, and integrations, so an authorization bypass at this layer can expose LLM provider credentials, API keys, and downstream systems, turning an app-level issue into an AI supply chain compromise.[5][6] Organizations should treat Langflow and similar orchestration platforms as critical AI infrastructure, include them in SBOM and dependency inventories, and perform continuous red teaming of AI workflows to detect insecure multi-tenant des