#KEV
All CosmicBytez Labs articles tagged #KEV, across news, security advisories, how-to guides, and projects.
- News
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
CISA added CVE-2026-65660 (SharePoint RCE, CVSS 8.8) and CVE-2026-67279 (MikroTik RouterOS, CVSS 6.9) to its KEV catalog citing active exploitation.
- News
CISA Warns of Active Exploitation of Three Linux Kernel Flaws
CISA added three Linux kernel CVEs to its KEV catalog, ordering federal agencies to patch and forensically triage by end of day.
- News
Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data
CISA adds a maximum-severity Oracle WebLogic and HTTP Server flaw to the KEV catalog as active exploitation is confirmed in the wild.
- News
CISA Warns of Hackers Exploiting Critical MLflow Vulnerability
CVE-2026-64849 (CVSS 9.3): Active SSRF exploitation in MLflow lets attackers steal AWS cloud credentials via redirect bypass. Added to CISA KEV.
- News
CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE
CISA added a critical Ray framework flaw to its KEV catalog. The vulnerability enables browser-based RCE in AI/ML distributed computing workloads.
- News
CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog on August 5, 2026 — a critical Langflow RCE, an Apache Tomcat encryption...
- News
CISA Orders Immediate Patching of Actively Exploited Fortinet FortiSandbox Flaws
CISA added two critical Fortinet FortiSandbox OS command injection vulnerabilities to its KEV catalog and gave federal agencies just three days to patch,...
- News
iCagenda and Balbooa Forms Joomla Flaws Exploited as Zero-Days
CISA has added two maximum-severity flaws in iCagenda and Balbooa Forms Joomla extensions to its KEV catalog following confirmed zero-day exploitation in...
- News
CISA Orders Feds to Prioritize Patching Langflow Auth Bypass Flaw
CISA added CVE-2026-55255, a CVSS 9.9 IDOR authorization bypass in Langflow, to its Known Exploited Vulnerabilities catalog on July 7, ordering U.S....
- News
CISA Sets Urgent Deadline to Fix Cisco Flaw Actively Exploited in Attacks
CISA has added a Cisco Unified Communications Manager Server vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to...
- News
CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue
CISA has added CVE-2026-12569, a critical remote code execution vulnerability in PTC Windchill PDMlink and FlexPLM, to its Known Exploited Vulnerabilities...
- Newsletter
June 17 Digest: Teams C2 Evasion, Copilot Data Theft, iRhythm Breach, cPanel KEV
DragonForce hides C2 inside Microsoft Teams relay traffic; a SearchLeak attack weaponizes M365 Copilot for one-click data exfiltration; iRhythm confirms...
- News
CISA Warns of Another Actively Exploited cPanel Plugin Flaw
CISA has added CVE-2026-54420, an actively exploited vulnerability in the LiteSpeed cPanel user-end plugin, to its Known Exploited Vulnerabilities catalog...
- News
CISA Gives Feds 3 Days to Patch Check Point VPN Bug Exploited as Zero-Day
CISA ordered federal agencies to patch a critical Check Point Remote Access VPN flaw within 3 days after Qilin ransomware affiliates were confirmed...
- News
CISA: Hackers Now Exploit SolarWinds Serv-U Flaw to Crash Servers
CISA added a high-severity SolarWinds Serv-U flaw to its KEV catalog after confirming attackers are actively exploiting it to crash file transfer servers.
- News
CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog
CISA has added a critical remote code execution vulnerability in the Mirasvit Cache Warmer Magento extension to its Known Exploited Vulnerabilities catalog…
- News
CISA Gives Feds 4 Days to Patch Actively Exploited cPanel Plugin Flaw
CISA's emergency directive gives federal agencies four days to patch the actively exploited LiteSpeed cPanel plugin flaw being weaponized in the wild.
- News
Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV
CISA has added CVE-2026-9082, a SQL injection vulnerability in Drupal Core, to its Known Exploited Vulnerabilities catalog following confirmed in-the-wild...
- News
CISA Gives Federal Agencies Four Days to Patch Actively
CISA has added a high-severity Ivanti Endpoint Manager Mobile vulnerability to the Known Exploited Vulnerabilities catalog and issued an emergency...
- News
CISA Adds Actively Exploited Linux Root Access Bug
The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-31431, a Linux kernel privilege escalation flaw enabling root access, to its...
- News
CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal
CISA has added four actively exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers to its Known...
- News
CISA: New Langflow Flaw Actively Exploited to Hijack AI
CISA has added CVE-2026-33017, a critical unauthenticated remote code execution vulnerability in the Langflow AI framework, to its Known Exploited...
- News
CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM
CISA has added CVE-2025-53521, a critical vulnerability in F5 BIG-IP Access Policy Manager, to its Known Exploited Vulnerabilities catalog after...
- News
CISA Adds Zimbra XSS and SharePoint RCE to KEV; Cisco FMC
CISA added actively exploited Zimbra Collaboration Suite and Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities catalog on March...
- Security
CISA Adds Two Actively Exploited Roundcube Webmail Flaws to KEV
CISA has added two Roundcube Webmail vulnerabilities to the Known Exploited Vulnerabilities catalog — CVE-2025-49113 (CVSS 9.9, deserialization RCE) and...
- Security
CISA Adds Four Critical Vulnerabilities to KEV Catalog
CISA has updated the Known Exploited Vulnerabilities catalog with four actively exploited flaws including Microsoft Office and SmarterMail vulnerabilities.