The US Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities catalog. These include CVE-2026-33017, a code injection flaw in Langflow, an open-source framework for building AI agents and workflows. The second is CVE-2026-33634, an embedded malicious code vulnerability in Aqua Security’s Trivy security scanner.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities catalog. These include CVE-2026-33017, a code injection flaw in Langflow, an open-source framework for building AI agents and workflows.
The second is CVE-2026-33634, an embedded malicious code vulnerability in Aqua Security’s Trivy security scanner. Their inclusion in the catalog mandates US federal civilian agencies to address these flaws by April 8 and 9.