cve recordexploit reported

CVE-2026-0768

CVSS—

Severitynone

Weakness—

EPSS22.9%97.7th percentile

Exploited1 KEV source

patch window

Called exploited 218 days after disclosure.

Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.

The life of this vulnerability

CVE publishedJan 23, 2026
First KEV listingAug 29, 20267mo
Last sightingSep 5, 20267d

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

CISA KEVUS federaldoes not list it
EUVDENISA, European Uniondoes not list it
VulnCheck KEVcommercial researchlisted Aug 29, 2026
CIRCLaggregator, mirrors the abovelisted Aug 29, 2026, not counted

Sources1 of 3

Listings differ by—

Strongest claimconfirmed

This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.

Public exploitation evidence

reported exploitationSep 5, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-0
reported exploitationSep 4, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-0
reported exploitationSep 3, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-0
reported exploitationSep 2, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-0
reported exploitationSep 1, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-0
reported exploitationAug 30, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-0

9 public reports collected from VulnCheck and CIRCL, first on Aug 29, 2026. Each links to its original source. We have not verified them.

Description

References

← Back to the CVE Tracker

Our coverage of CVE-2026-0768

CVE-2026-0768Sep 1, 2026critical

Critical Langflow flaw exploited to steal OpenAI and AWS keys

Threat actors are actively exploiting a critical unauthenticated remote code execution vulnerability, identified as CVE-2026-0768, in Langflow, an open-source framework for building AI applications. The attacks aim to steal credentials, tokens, and various API keys.