Understanding Langflow CVE-2026-55255, and why higher CVSS vulnerabilities aren't always the most exploited (opens in new tab)

The Sysdig TRT observed the first known exploitation of Langflow CVE-2026-55255, a CVSS 9.9 IDOR, alongside CVE-2026-33017, a CVSS 9.3 RCE, in the same session. Here's what the effort split tells us about how CVSS scores map to real-world risk.