CISA sounds alarm on Langflow RCE, Trivy supply chain compromise after rapid exploitation

CISA added two urgent entries to its Known Exploited Vulnerabilities catalog: a critical Langflow code-injection flaw (CVE-2026-33017) that was rapidly weaponized and used to exfiltrate keys/credentials, and a Trivy supply-chain compromise (CVE-2026-33634) attributed to TeamPCP that pushed malicious releases and credential-stealing malware, with downstream impacts including compromised LiteLLM packages; federal agencies are required to remediate, and vendors/security teams have published mitigation guidance.