Developer and AI tools in CISA KEV
38 known-exploited vulnerabilities in tools developers run locally; 11 for AI and ML tools were added in 2026, against 1 in 2025.
Updated October 1, 2026. Licensed CC BY 4.0.
38known-exploited vulnerabilities in tracked tools
19added in 2026, against 5 in 2025
11for AI and ML tools in 2026, against 1 in 2025
Read the trend with two caveats. We track tools that already have catalog entries, so tools with none never appear; and most of the AI tools here are only a few years old. The 2026 count covers the year so far, up to catalog version 2026.10.01.
Entries added to the catalog, by year
By tool
| Tool | Category | Entries |
|---|---|---|
| Jenkins | Self-hosted developer tools | 6 |
| Langflow | AI and ML tools | 6 |
| GitLab | Self-hosted developer tools | 5 |
| LiteLLM | AI and ML tools | 3 |
| Apache Airflow | Self-hosted developer tools | 2 |
| Grafana | Self-hosted developer tools | 2 |
| Metabase | Self-hosted developer tools | 2 |
| Adminer | Self-hosted developer tools | 1 |
| Apache Superset | Self-hosted developer tools | 1 |
| Gitea | Self-hosted developer tools | 1 |
| Gogs | Self-hosted developer tools | 1 |
| MLflow | AI and ML tools | 1 |
| mongo-express | Self-hosted developer tools | 1 |
| n8n | AI and ML tools | 1 |
| phpMyAdmin | Self-hosted developer tools | 1 |
| Ray | AI and ML tools | 1 |
| React Native CLI | Dev servers and frameworks | 1 |
| React Server Components | Dev servers and frameworks | 1 |
| Vite | Dev servers and frameworks | 1 |
Every entry
| CVE | Tool | Added | CISA description | Known ransomware use |
|---|---|---|---|---|
| CVE-2026-85706 | GitLab | 2026-09-11 | GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. | Unknown |
| CVE-2026-59822 | LiteLLM | 2026-09-02 | BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. | Unknown |
| CVE-2026-60004 | Gitea | 2026-08-25 | Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. | Unknown |
| CVE-2026-64849 | MLflow | 2026-08-19 | MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body. | Unknown |
| CVE-2025-62593 | Ray | 2026-08-17 | Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. | Unknown |
| CVE-2026-72898 | Metabase | 2026-08-11 | Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. | Unknown |
| CVE-2026-9198 | Langflow | 2026-08-04 | Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. | Unknown |
| CVE-2026-0770 | Langflow | 2026-07-21 | Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. | Unknown |
| CVE-2026-55255 | Langflow | 2026-07-07 | Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. | Unknown |
| CVE-2026-42271 | LiteLLM | 2026-06-08 | BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host. | Unknown |
| CVE-2025-34291 | Langflow | 2026-05-21 | Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints. | Unknown |
| CVE-2026-42208 | LiteLLM | 2026-05-08 | BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages. | Unknown |
| CVE-2026-33017 | Langflow | 2026-03-25 | Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication. | Unknown |
| CVE-2025-68613 | n8n | 2026-03-11 | n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution. | Unknown |
| CVE-2021-22175 | GitLab | 2026-02-18 | GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled. | Unknown |
| CVE-2025-11953 | React Native CLI | 2026-02-05 | React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments. | Unknown |
| CVE-2021-39935 | GitLab | 2026-02-03 | GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API. | Unknown |
| CVE-2025-31125 | Vite | 2026-01-22 | Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. | Unknown |
| CVE-2025-8110 | Gogs | 2026-01-12 | Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution. | Unknown |
| CVE-2025-55182 | React Server Components | 2025-12-05 | Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182. | Known |
| CVE-2021-43798 | Grafana | 2025-10-09 | Grafana contains a path traversal vulnerability that could allow access to local files. | Unknown |
| CVE-2017-1000353 | Jenkins | 2025-10-02 | Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism. | Unknown |
| CVE-2021-21311 | Adminer | 2025-09-29 | Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information. | Unknown |
| CVE-2025-3248 | Langflow | 2025-05-05 | Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests. | Known |
| CVE-2021-41277 | Metabase | 2024-11-12 | Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data. | Unknown |
| CVE-2024-23897 | Jenkins | 2024-08-19 | Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution. | Known |
| CVE-2023-7028 | GitLab | 2024-05-01 | GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover. | Unknown |
| CVE-2023-27524 | Apache Superset | 2024-01-08 | Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions. | Unknown |
| CVE-2015-5317 | Jenkins | 2023-05-12 | Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages. | Unknown |
| CVE-2021-39226 | Grafana | 2022-08-25 | Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss. | Unknown |
| CVE-2019-1003029 | Jenkins | 2022-04-25 | Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox. | Unknown |
| CVE-2009-1151 | phpMyAdmin | 2022-03-25 | Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. | Unknown |
| CVE-2019-1003030 | Jenkins | 2022-03-25 | Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution. | Unknown |
| CVE-2018-1000861 | Jenkins | 2022-02-10 | A code execution vulnerability exists in the Stapler web framework used by Jenkins | Unknown |
| CVE-2020-11978 | Apache Airflow | 2022-01-18 | A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow. | Unknown |
| CVE-2020-13927 | Apache Airflow | 2022-01-18 | The previous default setting for Airflow's Experimental API was to allow all API requests without authentication. | Unknown |
| CVE-2019-10758 | mongo-express | 2021-12-10 | mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. | Unknown |
| CVE-2021-22205 | GitLab | 2021-11-03 | GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files. | Known |
Sharing a local tool without exposing it
Source: CISA Known Exploited Vulnerabilities Catalog, version 2026.10.01 (1731 entries). To show one of these tools to someone without giving it a public address, see sharing a dev server and sharing a local LLM.
Reproduce it
The script that builds this dataset is in the LayerV website repository. Run it from the repository root:
node scripts/research/build-dev-tool-kev.mjsFrequently Asked Questions
Which developer tools are in the CISA KEV catalog?
As of catalog version 2026.10.01, 38 entries cover 19 of the tools we track, including Vite, React Server Components, Langflow, n8n, Ray, MLflow, LiteLLM, Jenkins, GitLab, and Grafana.
Is it dangerous to expose a dev server with a tunnel?
Dev servers are not built for hostile traffic. CISA added CVE-2025-31125 in Vite to its exploited list on 2026-01-22; CISA notes that only dev servers exposed to the network are affected. A public tunnel URL also makes a dev server reachable from the internet.
How is this list built?
A script matches CISA’s own vendor and product fields against a curated list of developer, AI, and self-hosted tools. It never keyword-searches descriptions, so unrelated products are not swept in.
Cite this
LayerV (2026). Developer and AI tools in CISA KEV. https://layerv.ai/research/dev-tool-kev (updated 2026-10-01). CC BY 4.0.