kev
U.S. CISA adds an MLflow flaw to its Known Exploited Vulnerabilities catalog
CISA has added a critical server-side request forgery (SSRF) vulnerability in MLflow to its Known Exploited Vulnerabilities catalog. Tracked as CVE-2026-64849 with a CVSS score of 9.3, the flaw allows unauthenticated attackers to make requests from exposed MLflow servers to internal services, potentially stealing cloud credentials. Exploitation has been observed in the wild, with active scanning for vulnerable instances occurring shortly after the CVE was assigned.
U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch them by specific deadlines. The vulnerabilities affect Cisco Secure Firewall, Microsoft Windows, and Metabase, with the Metabase flaw being a critical SQL injection that was actively exploited.
CISA Adds Progress LoadMaster Command Injection Flaw to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Progress LoadMaster products to its Known Exploited Vulnerabilities catalog. This OS command injection flaw, tracked as CVE-2026-8037, allows unauthenticated attackers to execute arbitrary commands remotely. Exploitation attempts were observed as early as June 29, 2026, shortly after a proof-of-concept exploit became available.
CISA Adds Fortinet and Microsoft Flaws to Exploited Vulnerabilities List
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added critical vulnerabilities affecting Fortinet FortiSandbox and Microsoft SharePoint to its Known Exploited Vulnerabilities catalog. The flaws include OS command injection in FortiSandbox and a deserialization vulnerability in SharePoint that allows for remote code execution without authentication. Microsoft has confirmed active exploitation of the SharePoint flaw.
U.S. CISA adds Adobe ColdFusion, Joomlack Page Builder, Langflow, and JoomShaper SP Page Builder flaws to its Known Exploited Vulnerabilities catalog
The U.S. CISA has added several vulnerabilities to its catalog of actively exploited flaws. These include a critical path traversal vulnerability in Adobe ColdFusion that allows for unauthenticated code execution, and multiple issues affecting Joomlack Page Builder and JoomShaper SP Page Builder that can lead to unauthorized access and malicious file uploads. Organizations are urged to update affected software immediately.
CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV
CISA has incorporated four new vulnerabilities into its Known Exploited Vulnerabilities (KEV) catalog. These flaws, affecting products from Adobe, Joomla, and Langflow, are all currently under active exploitation.